vulnerability context

CVE-2026-56290

CVSS 9.8 CRITICALEPSS 28%CWE-434OTX 5 pulses

The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Published 2026-06-29 · last modified 2026-07-07

details

CISA KEV status: Not in catalog
CVSS v3: 9.8 / CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 28% percentile (score 0.0036)
CWE: CWE-434
OTX pulses: 5 total, 0 recent

View on NVD → · cve.org

source mentions 2

[CSIRTS.COM] 🚨 Added to CISA KEV — actively exploited: CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerab...Bluesky · 3h ago
CISA Adds Three Known Exploited Vulnerabilities to CatalogCISA Alerts · 8h ago

source consensus

Bluesky1×
CISA Alerts1×

Want the 3-bullet summary of CVE-2026-56290, plus webhook alerts when KEV is updated? Pro is $10/mo.

Open in reader See Pro →