CVE-2026-66915 is a critical vulnerability in the Fabrik extension for Joomla, specifically affecting versions up to 4.6.8. It allows unauthenticated remote attackers to execute arbitrary code by leveraging the ajax_calc feature of the calc plugin. This vulnerability is categorized under CWE-94, which involves improper control of code generation leading to code injection. The CVSS 4.0 base score is 10.0, reflecting its critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary code on the target system, potentially leading to full system compromise. This can result in unauthorized access, data theft, system manipulation, or disruption of services. The critical CVSS score of 10.0 indicates maximum impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or restrict access to the ajax_calc feature of the calc plugin if possible, and monitor for any suspicious activity related to this component.