PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73337 Joomla! Project CVE debrief

CVE-2026-73337 is a high-severity vulnerability in Joomla! Core, affecting versions 4.0.0-5.4.7 and 6.0.0-6.1.2. The vulnerability allows for MFA authentication bypass due to insufficient state checks. This issue impacts organizations using Joomla! Core, as it could allow attackers to bypass 2FA checks, potentially leading to unauthorized access. Defenders and administrators should assess exposure and prioritize verification and remediation efforts. The CVE record and NVD vulnerability detail provide information on the vulnerability, its severity, and affected versions.

Vendor
Joomla! Project
Product
Joomla! CMS
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-09-03
Advisory published
2026-08-18
Advisory updated
2026-09-03

Who should care

Defenders and administrators of Joomla! Core installations should assess exposure and prioritize verification and remediation efforts. This includes verifying affected versions, implementing compensating controls, and monitoring for suspicious activity. Security teams should review the CVE record and NVD vulnerability detail to understand the vulnerability and its potential impact.

Why it matters

CVE-2026-73337 is a high-severity vulnerability in Joomla! Core that allows for MFA authentication bypass. Defenders and administrators should assess exposure, prioritize verification and remediation, and implement compensating controls.

  • Verification of affected versions and exposure
  • Potential authentication bypass
  • Remediation priority for vulnerable versions

Technical summary

The vulnerability allows for MFA authentication bypass due to insufficient state checks in Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2. This issue is caused by a lack of proper validation in the authentication process, allowing attackers to bypass 2FA checks. Defenders should prioritize verifying and upgrading to patched versions, assessing exposure, and implementing compensating controls.

Defensive priority

Defenders should prioritize verifying and upgrading to patched versions, assessing exposure, and implementing compensating controls.

Recommended defensive actions

  • Verify and upgrade to patched versions of Joomla! Core
  • Assess exposure and implement compensating controls
  • Monitor for suspicious activity

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its severity, and affected versions. The vulnerability has been publicly disclosed and is being actively monitored. Defenders should verify affected versions and exposure, and prioritize remediation efforts. The vendor has provided guidance on patched versions and mitigation strategies. Evidence is limited to public sources, and further verification is recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73337 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73337

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73337 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73337

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.