Joomla CMS Critical Vulnerabilities CVSS 9.8

CERT-Bund Security Advisories

Published March 31st, 2026

Detected April 1st, 2026

Summary

CERT-Bund published security advisory WID-SEC-2026-0936 identifying critical vulnerabilities in Joomla CMS with CVSS Base Score 9.8. Affected versions include Open Source Joomla CMS prior to 5.4.4 and 6.0.4 across Windows and UNIX systems. An attacker can exploit these vulnerabilities remotely to bypass security controls, execute SQL injection attacks, manipulate data, or perform cross-site scripting.

View original document View source feed page

What changed

CERT-Bund issued advisory WID-SEC-2026-0936 regarding multiple critical vulnerabilities in Joomla CMS. The vulnerabilities affect Open Source Joomla CMS versions below 5.4.4 (released 31.03.2026) and below 6.0.4, impacting installations on Windows and UNIX operating systems. The CVSS Base Score is 9.8 (critical) with a Temporal Score of 8.5 (high). Attack vectors allow remote exploitation for security bypass, SQL injection, data manipulation, and XSS attacks.

Organizations running affected Joomla CMS installations should immediately apply available mitigations and update to patched versions. Website operators and technology companies using Joomla should assess their exposure, prioritize patching, and monitor for indicators of compromise. No specific compliance deadline or regulatory penalty information is provided in this advisory.

What to do next

Update Joomla CMS to version 5.4.4 or higher, or 6.0.4 or higher
Assess all Joomla installations within the organization for exposure
Monitor for indicators of compromise if running vulnerable versions

Source document (simplified)

[WID-SEC-2026-0936] Joomla CMS: Mehrere Schwachstellen CVSS Base Score 9.8 (kritisch) CVSS Temporal Score 8.5 (hoch) Remoteangriff ja Datum 31.03.2026 Stand 01.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

Sonstiges
UNIX
Windows

Produktbeschreibung

Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Produkte

31.03.2026
- Open Source Joomla CMS <5.4.4

Open Source Joomla CMS <6.0.4

Angriff

Ein Angreifer kann mehrere Schwachstellen in Joomla CMS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, SQL-Injection-Angriffe durchzuführen, Daten zu manipulieren oder Cross-Site-Scripting-Angriffe auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben