PatchTheCEVjoomla\! vulnerabilities and fixes
Recent CVEs affecting joomla\!, with upgrade or downgrade steps. 10 tracked.
joomla\! has 10 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-08-18. Highest priority: CVE-2026-73373 (score 52/100).
- CVE-2026-73373 CRITICAL 9.8 UPGRADE Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The defau
- CVE-2026-73337 HIGH 7.5 UPGRADE Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient sta
- CVE-2026-71573 HIGH 8.3 UPGRADE Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper i
- CVE-2026-71574 MEDIUM 6.5 UPGRADE Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6
- CVE-2026-73336 MEDIUM 6.4 UPGRADE Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escap
- CVE-2026-72532 MEDIUM 5.4 UPGRADE Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0
- CVE-2026-71572 MEDIUM 5.4 UPGRADE Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - L
- CVE-2026-72531 MEDIUM 5.4 UPGRADE Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7,
- CVE-2026-73371 MEDIUM 4.3 UPGRADE Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An
- CVE-2026-73372 MEDIUM 4.3 UPGRADE Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 a
FAQ
How do I fix joomla\! vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is joomla\! being exploited right now?
None of the tracked joomla\! CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which joomla\! CVE should I patch first?
CVE-2026-73373 currently ranks highest (52/100): Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The defau.