CVE‑2026‑48907 in Joomla's popular JCE editor scores a perfect CVSS 10.0, is listed in CISA's KEV catalog as actively exploited, and can be triggered by an unauthenticated attacker with just three HTTP requests, prompting urgent patching and thorough post‑patch forensics.
A CVSS 10.0 unauthenticated remote code execution vulnerability (CVE‑2026‑48907) in Joomla's JCE Editor allows attackers to upload malicious PHP files via the profiles.import endpoint, affect all JCE versions up to 2.9.99.4, and can be exploited with the JoomlaSniper tool, while mitigation requires upgrading to JCE 2.9.99.5 or blocking PHP execution in /tmp/ and /images/.
The June API security report highlights three critical vulnerabilities—MinIO unauthorized data exposure, Joomla Rest API unauthenticated access, and multiple Argo CD API flaws—detailing their impacts and providing concrete remediation steps to protect sensitive data and maintain system integrity.
