CVSS7.5
Severityhigh
WeaknessCWE-284
EPSS0.99%62.2th percentile
Exploited2 KEV sources
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
patch window
Called exploited 11 days after disclosure.
Measured from the CVE publication date to the earliest of 2 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing11d
- Last KEV listing32d
- Last sightingsame day
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Unionlisted Jul 10, 2026
- VulnCheck KEVcommercial researchlisted Aug 11, 2026
- CIRCLaggregator, mirrors the abovelisted Jul 10, 2026, not counted
Sources2 of 3
Listings differ by32 d
Strongest claimconfirmed
2 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationprevidian.com/CVE-2026-49049
1 public report collected from VulnCheck and CIRCL, first on Aug 11, 2026. Each links to its original source. We have not verified them.
Description
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.