Dashboard / CVE-2026-48939

CVE-2026-48939

CRITICAL CISA KEV
ACT NOW Priority: 2.01 BB Relevance: 84/100
Published: 2026-06-20 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

CISA Known Exploited Vulnerability

Vendor / Product iCagenda — iCagenda
Date Added 2026-07-10
Remediation Due 2026-07-13
https://www.icagenda.com/#download ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48939

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
joomlic icagenda 3.2.1 – 3.9.15
joomlic icagenda 4.0.0 – 4.0.8

References & Advisories (6)

Bug Bounty Relevance

84 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ Known exploited (KEV)

CVSS Score

10.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

EPSS — Exploitation Probability

20.07%
Raw Score 0.200690
Percentile 97.4%
Date 2026-10-28

Intelligence Sources

kev ref →
nvd ref →

External Links