CVE-2026-66915 is a critical vulnerability classified as CWE-94 (Improper Control of Generation of Code) in the Fabrik extension for Joomla. Versions from 1.0.0 up to and including 4.6.6 are affected. The flaw allows unauthenticated attackers to remotely execute arbitrary code by leveraging the ajax_calc feature of the calc plugin, potentially leading to full system compromise. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the target system, which can lead to complete system compromise, data loss, or service disruption. The vulnerability affects the confidentiality, integrity, and availability of the affected Joomla extension and potentially the hosting environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links have been provided at this time. Users should monitor the vendor's announcements for updates and consider disabling or restricting access to the ajax_calc feature of the calc plugin as a temporary mitigation until a patch is available.