Multiple vulnerabilities in Joomla! (August 19, 2026)

unknownCVE-2026-73371 CVE-2026-73337 CVE-2026-73336 CVE-2026-71574 CVE-2026-71572 CVE-2026-72532

Multiple vulnerabilities have been discovered in Joomla!. Some of them allow an attacker to cause remote arbitrary code execution, data integrity breach and remote indirect code injection (XSS).

CSIRTS triage

vendor: Joomla product: Joomla Remote code execution Cross-site scripting Code injection

What: Multiple vulnerabilities enable remote arbitrary code execution, data integrity breach, and remote indirect code injection via XSS.
Who is affected: Joomla deployments running affected versions.
Urgency: Critical; remote arbitrary code execution vulnerabilities require immediate patching to prevent system compromise.
Action: Update Joomla to the latest patched version addressing all listed CVEs.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Joomla

Get an email when a new Joomla advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-08-19
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1046/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-733710.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-733370.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-733360.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-715740.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-715720.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-725320.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-733730.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-725310.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-715730.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-733720.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-73371	coverage & exploitation status	NVD · CVE.org
CVE-2026-73337	coverage & exploitation status	NVD · CVE.org
CVE-2026-73336	coverage & exploitation status	NVD · CVE.org
CVE-2026-71574	coverage & exploitation status	NVD · CVE.org
CVE-2026-71572	coverage & exploitation status	NVD · CVE.org
CVE-2026-72532	coverage & exploitation status	NVD · CVE.org
CVE-2026-73373	coverage & exploitation status	NVD · CVE.org
CVE-2026-72531	coverage & exploitation status	NVD · CVE.org
CVE-2026-71573	coverage & exploitation status	NVD · CVE.org
CVE-2026-73372	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Joomla!

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-78080: Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - T…nvd · 2026-09-03
unknownCVE-2026-78069: Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain …nvd · 2026-09-03
unknownCVE-2026-78065: Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated use…nvd · 2026-09-03
unknownCVE-2026-78064: Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` t…nvd · 2026-09-03
unknownCVE-2026-78000: Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` …nvd · 2026-09-03
unknownCVE-2026-77999: Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order c…nvd · 2026-09-03