CVE-2026-48901: Joomla Joomla\!

What is CVE-2026-48901?

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

CVSS7.5 NVD 3.1

SeverityHIGH

ExploitationNo exploitation reported

EPSS<1% · P16

Triage statusNo Known Exploit

ActionPatch this week

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD published2026-05-26

NVD last modified2026-06-17

Timeline

2026-05-26Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated

Affected product

Joomla Joomla\!

Remediation Steps

Identify all MAXHUB Pivot Client installations in use
Notify all tenant users of potential email exposure and advise monitoring
Update MAXHUB Pivot Client to patched version
Review access logs for unauthorized enumeration of email addresses
Reset credentials for exposed tenant accounts as precaution

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of May 2026 (May 11 – 17)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.