CISA Flags Two Joomla Extension Zero-Days Under Active Exploitation

CISA added two critical Joomla extension flaws (CVE-2026-48939 and another) to its KEV catalog after reports of zero-day exploitation. Both vulnerabilities carry a CVSS score of 10.0, indicating maximum severity. The flaws affect iCagenda and Balbooa extensions, widely used for event management and form building.