Hazard

Is CVE-2026-48939 being exploited?

Confirmed exploited in the wild

CISA has evidence of active exploitation. This is not theoretical risk — someone has already used it against someone.

iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda · iCagenda

CVSS 10 EPSS 24% no public exploit indexed Fix deadline passed 13 July 2026

What it is

iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Why we say that

  • CISA's federal remediation deadline (2026-07-13) has passed
  • CVSS 10 critical
  • Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What it costs when this goes wrong

This is where UK enforcement meets the vulnerability record. Where an unfixed vulnerability leads to a breach, the ICO treats it as a security failure under UK GDPR. Recent cases:

All UK cases caused by unpatched software →