CISA orders feds to patch max severity Joomla plugin flaw by Friday
Source Bleeping Computer
Mentioned vulnerabilities
Fixed in 2.9.99.6 : patch affected systems soon.
Data as of 17 Jun 2026, 18:01 UTC
Rated High by Threat Radar from the Bleeping Computer text
- Patch
- Available – fixed in 2.9.99.6
What to do
AI-suggested
A patch is available in JCE Pro version 2.9.99.6. Users should update immediately to this version or later. For sites already compromised, update the plugin, back up and investigate rogue editor profiles, delete attacker profiles, change all relevant passwords (administrator, database, hosting), and perform a full server-side malware scan to ensure no residual malicious code remains. CISA requires federal agencies to prioritize patching per BOD 26-04. If mitigations are unavailable, discontinuing use of the vulnerable product is advised.
Description
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity flaw in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited in the wild. [...]