Balbooa Forms unauthenticated RCE exploited (CVE-2026-56291)

Actively exploited in the wild - CVE-2026-56291 is a critical unauthenticated arbitrary file upload in the Balbooa Forms extension for Joomla that gives attackers full remote code execution on the server. No vendor patch is available yet; apply the mitigations below immediately.

Overview

CVE-2026-56291 is a CRITICAL (CVSS 10.0) vulnerability in the Balbooa Forms extension, a popular form-building component for Joomla!. The flaw allows any unauthenticated attacker to upload arbitrary files, including executable web shells, to the server. Once uploaded, the attacker can execute commands, access the database, steal credentials, and pivot to other systems on the network. No authentication, user interaction, or special privileges are required for exploitation.

Impact

The vulnerability carries the maximum possible CVSS severity score of 10.0. An attacker with network access to a vulnerable Joomla! site can gain full remote administrative control of the web server without any prior access. This includes the ability to read, modify, or delete all files and data, install malware, and use the compromised server as a launch point for further attacks. Given the active exploitation status, any publicly-facing Joomla! site running the Balbooa Forms extension is at immediate risk of compromise.

Remediation and Mitigation

As of the publication of this advisory, no patched version of the Balbooa Forms extension has been released by the vendor. The following mitigation steps are recommended:

1. Immediately disable the Balbooa Forms extension in the Joomla! Extension Manager until a security update is available and applied.
2. If the extension cannot be disabled, restrict network access to the Joomla! administrative interface using a firewall or web application firewall (WAF).
3. Inspect the web root directory for any unrecognized .php or executable files uploaded after the KEV publication date (obtain the exact date from your CISA KEV feed). Remove any suspicious files and rotate all administrative and database passwords.
4. Monitor server logs for POST requests to the component’s file-upload endpoint and block the source IPs.

Security Insight

CVE-2026-56291 is a textbook example of a file-upload vulnerability that should have been prevented by basic validation-checking file extensions and MIME types on the server side. The assignment of a CVSS 10.0 score indicates there are no mitigating controls (like authentication requirements or network segmentation) built into the software. This vulnerability underscores a broader trend in which third-party extensions for major CMS platforms represent a critical, and often overlooked, supply-chain risk. For the latest data breach reports, see our breach reports. For ongoing cybersecurity news, see security news.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs