Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Jun 19, 2026.

1. Check whether you run joomlacontenteditor.net Joomla Content Editor (JCE) extension for Joomla and which version.
2. No patched version is listed yet. Limit access to the affected service to trusted networks, and disable the feature if you can.
3. Subscribe to the vendor advisory so you learn when a fix ships.
4. Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.