CVE-2026-77991: Critical RCE in Joomla Event Manager — Public PoC, Patch to 5.0.1 Now

TL;DR

CVE-2026-77991 is a critical, privileged remote code execution (RCE) vulnerability in the Joomla Event Manager extension (joomlaeventmanager) for Joomla, affecting versions before 5.0.1. The Joomla security team assigned a CVSS 4.0 base score of 9.4 (CRITICAL), and a public proof-of-concept (PoC) is available on GitHub. The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation has been observed in the wild — not merely theorized. If you run Joomla with the Event Manager extension and have not upgraded to 5.0.1, assume your instance is compromised until you can prove otherwise. Patch immediately, validate exposure, and hunt for indicators of compromise (IoCs).

What is CVE-2026-77991?

CVE-2026-77991 is a privileged remote code execution flaw in Joomla Event Manager, a popular extension used to publish and manage events on Joomla-based websites. The vulnerability resides in the administrator-side source model, which allows an authenticated administrator to write dangerous file types — including PHP — to locations that the web server will execute. This crosses the trust boundary between the administrative control plane and the web-executable content plane, turning a privileged file-write into full code execution.

The flaw affects Joomla Event Manager versions prior to 5.0.1. The fix is available in 5.0.1. The vulnerability was published on 2026-08-27 and added to the CISA KEV catalog the same day. A public PoC repository exists at https://github.com/abraxas/CVE-2026-77991, lowering the skill barrier for opportunistic attackers.

Technical details

Root cause

The root cause is an unsafe file-write path in the administrator-side source model of Joomla Event Manager. The component allows an administrator to supply or influence file content and file type during a save operation, and it does not sufficiently restrict the extension or MIME type of the resulting file. Because the write target is reachable from the web root (or a path that the web server will execute), an attacker who already holds administrator privileges can drop a PHP file and then request it over HTTP to achieve code execution in the context of the web server user.

CVSS 4.0 vector

The Joomla security team assigned a CVSS 4.0 base score of 9.4 (CRITICAL) with the vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

This confirms:

• Network reachability (AV:N)
• Low attack complexity (AC:L)
• No user interaction (UI:N)
• High impact across confidentiality, integrity, and availability for both the vulnerable system and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
• Privileges required: high (PR:H)

The PR:H component is important: this is not an unauthenticated bug. However, administrator access is a realistic stepping stone in Joomla environments where credential reuse, weak admin passwords, or a prior lower-severity bug can yield elevated sessions.

Weakness classification

The behavior described is consistent with CWE-434 (Unrestricted Upload of File with Dangerous Type) and, more broadly, CWE-94 (Improper Control of Generation of Code). No CWE was formally assigned in the source intel, but these classes capture the essence of the flaw.

Affected versions

• Vulnerable: Joomla Event Manager < 5.0.1
• Fixed: Joomla Event Manager 5.0.1 and later

Why this matters: RCE + public PoC + KEV

The combination of remote code execution, a public proof-of-concept, and a CISA KEV listing is a worst-case scenario for defenders. RCE gives an attacker the ability to run arbitrary code on your server, which typically means full control over the application and potentially the underlying host. A public PoC lowers the barrier to entry, allowing even low-skilled attackers to exploit the flaw. The KEV listing indicates that exploitation has been observed in the wild, so this is not a theoretical risk.

Even though the EPSS score is currently low (0.00414, ~35th percentile), the KEV listing and public PoC should override exploit-likelihood modeling. Do not use EPSS to deprioritize this issue.

Exposure validation: are you affected?

To determine if your environment is exposed:

1. Inventory Joomla instances across your organization, including internet-facing sites, internal portals, and staging environments.
2. Identify installations of Joomla Event Manager (component name: com_joomlaeventmanager). Check the extension list in the Joomla administrator panel or query the database (#__extensions table).
3. Determine the version of Joomla Event Manager. Versions below 5.0.1 are vulnerable.
4. Assess administrator access controls. If administrator accounts are not protected with MFA, strong unique passwords, and network restrictions, the risk is significantly higher.
5. Check for public exposure. Any internet-facing Joomla site with the vulnerable extension is a priority for patching.

If you cannot immediately patch, consider temporarily disabling or removing the Event Manager component until you can upgrade.

Impact

Successful exploitation yields remote code execution as the web server user. In typical Joomla deployments, this means the attacker can:

• Read configuration files, including database credentials in configuration.php
• Pivot to the underlying database
• Modify site content, inject web shells, deface pages, or add malicious JavaScript to steal visitor credentials
• Alter event listings to distribute phishing links
• Delete files, corrupt the database, or use the host as a staging point for further attacks
• Use the compromised host for outbound scanning, spam relay, or as a loader for additional malware

Because Joomla sites often share hosting with other applications, a compromised instance can become a beachhead into a shared environment. Business exposure includes regulatory notification obligations if personal data is accessible, reputational damage from defacement or SEO poisoning, and the operational cost of full rebuilds when persistence is discovered late.

Exploitation steps (defensive summary)

Understanding the attack chain helps defenders prioritize detection and response. The following is a high-level summary — no weaponized exploit code is provided.

1. Identify internet-facing Joomla sites running the Event Manager extension and fingerprint the version.
2. Obtain or abuse an administrator session — through credential stuffing, password reuse, a previously compromised admin account, or another vulnerability that yields elevated access.
3. Navigate to the administrator-side source model functionality in the Event Manager component that permits file creation or editing.
4. Submit content that includes PHP code and a filename with a PHP-executable extension, relying on the missing file-type restriction.
5. Request the newly written file over HTTP to trigger execution in the web server context.
6. Use the resulting execution context to enumerate the host, read configuration.php, and establish persistence (web shell, scheduled task, or modified template).
7. Pivot to the database or adjacent services using harvested credentials, and stage additional tooling.
8. Cover tracks by removing or renaming uploaded artifacts and clearing relevant Joomla and web server logs where permissions allow.

Indicators of compromise (IoCs)

Defenders should hunt for the following signs of exploitation:

• Unexpected PHP files in Joomla component, media, tmp, or cache directories, especially with random or double extensions (e.g., .php.jpg, .phtml, .php7).
• POST requests to administrator Event Manager endpoints that include PHP tags or base64-encoded payloads in file-content parameters.
• New or modified administrator accounts, or administrator logins from unusual geographies or ASNs.
• Outbound connections from the web server to unfamiliar IPs, especially on common C2 ports, or DNS lookups for newly registered domains.
• Web server access logs showing direct GET requests to files that were created shortly beforehand, with 200 responses and small response bodies.
• Changes to configuration.php, .htaccess, or Joomla template files outside of change windows.
• EDR or file-integrity monitoring alerts on writes to web-accessible directories by the web server user.
• Database queries or scheduled tasks created unexpectedly, or new Joomla users with elevated group membership.

Mitigation and workarounds

Primary mitigation: patch to 5.0.1

Upgrade Joomla Event Manager to 5.0.1 or later immediately. This is the only complete fix. If you use a managed Joomla host or a deployment pipeline, push the update through your change process as an emergency patch.

Interim workarounds (if patching is delayed)

If immediate upgrade is not possible:

• Restrict administrator access to trusted networks or VPN.
• Enforce strong unique passwords and MFA for all administrator accounts.
• Disable or remove the Event Manager component until patching can be completed.
• Apply file-integrity monitoring and a web application firewall (WAF) rule set that blocks PHP file uploads to component and media directories.
• Harden the web server so that only intended directories are executable, and disable execution in upload, tmp, and media paths.
• Rotate all credentials that may have been exposed if compromise is suspected, and review administrator accounts for unauthorized additions.

Because the vulnerability is in CISA KEV, follow your incident response plan for known-exploited issues, including forensic triage before restoring service.

Detection and hunting guidance

• File integrity monitoring (FIM): Alert on new PHP files in web-accessible directories, especially those created by the web server user.
• Web server logs: Look for POST requests to Event Manager administrator endpoints followed by GET requests to newly created files. Correlate timestamps.
• Joomla logs: Review administrator login logs for anomalous IPs or times. Check for new administrator accounts.
• EDR: Monitor for process creation from the web server user (e.g., www-data, apache, nginx) spawning shells or scripting interpreters.
• Network: Detect outbound connections from web servers to unknown destinations, especially on non-standard ports.

Community reactions

Security media and vulnerability trackers flagged CVE-2026-77991 as critical and noted the combination of a KEV listing with a public proof-of-concept, which is unusual and raises urgency. The Joomla security team published the advisory and assigned the CVSS 4.0 score, and community discussion has focused on the privileged nature of the bug — it requires administrator access, but that access is often obtainable in real-world Joomla deployments. Practitioners have emphasized that the public PoC lowers the skill barrier and that the KEV listing should override low EPSS scores when prioritizing remediation. Some commentary has highlighted the recurring pattern of file-upload and file-write flaws in Joomla extensions as a category that defenders should monitor continuously.

Additional resources

• Joomla Security Advisory for CVE-2026-77991 (security@joomla.org)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Public proof-of-concept repository: https://github.com/abraxas/CVE-2026-77991
• NVD entry for CVE-2026-77991: https://nvd.nist.gov/vuln/detail/CVE-2026-77991
• Joomla Event Manager project: https://joomlaeventmanager.net

FAQ

Is CVE-2026-77991 in CISA KEV?

Yes. According to the sources provided, CVE-2026-77991 was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-08-27. This indicates that exploitation has been observed in the wild.

Is there a public proof-of-concept?

Yes. A public PoC repository exists on GitHub at https://github.com/abraxas/CVE-2026-77991. This lowers the barrier for attackers and increases the urgency of patching.

What versions are affected?

Joomla Event Manager versions before 5.0.1 are vulnerable. The fix is in 5.0.1.

Does this require authentication?

Yes. The vulnerability requires administrator-level privileges (PR:H in the CVSS vector). However, administrator access is often obtainable through credential reuse, weak passwords, or other vulnerabilities, so this should not be treated as a low-risk issue.

What is the CVSS score?

The Joomla security team assigned a CVSS 4.0 base score of 9.4 (CRITICAL).

What should I do if I cannot patch immediately?

Restrict administrator access to trusted networks, enforce MFA, disable or remove the Event Manager component, and apply file-integrity monitoring and WAF rules to block PHP uploads. Treat any unpatched instance as potentially compromised and hunt for IoCs.

How can I detect exploitation?

Look for unexpected PHP files in web-accessible directories, anomalous administrator logins, outbound connections from the web server, and changes to core Joomla files. See the IoCs section for a full list.

Is this vulnerability being actively exploited?

The KEV listing indicates that exploitation has been observed. The public PoC further increases the likelihood of opportunistic attacks. Patch immediately.