CISA KEV active-exploitation listing plus NVD/vendor/reference enrichment.
Defender Action Panel
Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.
Forms Balbooa CVE-2026-56291
CISA added CVE-2026-56291 to the Known Exploited Vulnerabilities catalog on 2026-07-10, marking credible active exploitation of Balbooa Forms [1]. NVD records the issue as an unrestricted upload of dangerous file types in the Joomla extension and marks the CVSS 4.0 exploit maturity as attacked [2]. This post treats the item as an exploited-vulnerability response workflow, not as proof that a software supply-chain channel or vendor infrastructure was compromised.
NVD's Joomla CNA record lists affected versions as balbooa-forms 1.0-2.4.0 [2]. CISA requires vendor-directed mitigation by 2026-07-13 [1]. Public sources reviewed during this cron did not provide a more precise fixed version string; operators should verify installed extension metadata against vendor release/download guidance before closure [3].
Use scripts/scope_balbooa-forms-cve-2026-56291-kev.py against exported CMDB, vulnerability scanner, web-server, EDR, ticket, and configuration inventories. A positive hit means the environment references CVE-2026-56291, Balbooa, Forms, or the affected-version selector and needs product-specific triage. The script is offline-only and does not contact vendor, CISA, or NVD systems.
Containment starts by locating internet-facing Joomla sites that run Forms and preserving evidence before cleanup. Capture web roots, extension upload directories, access logs, application logs, file modification timelines, process listings, and a UTC chain-of-custody record with evidence hashes and storage owner. Because the vulnerability class allows arbitrary executable upload, responders should look for new PHP/webshell-like files, unexpected extension changes, abnormal child processes from the web server account, persistence in scheduled tasks or Joomla extension/plugin configuration, and outbound connections from the affected host.
Eradication requires applying vendor mitigations or moving outside the affected version range, removing unauthorized uploaded executable files only after preservation, and reviewing administrator sessions and application secrets if exploitation succeeded. Recovery should include a post-fix scan, validation that the upload path no longer permits executable upload, review of backup integrity, and post-recovery monitoring for repeated upload attempts.
No attacker-controlled domains, IPs, URLs, hashes, or filenames were provided by CISA, NVD, or vendor sources reviewed here. The IOC arrays therefore intentionally remain empty except for product and version selectors. Source and advisory URLs are kept in detection selectors rather than being emitted as incident IOCs.
[1] CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-56291. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json opens in a new tab [2] NVD detail page for CVE-2026-56291. https://nvd.nist.gov/vuln/detail/CVE-2026-56291 opens in a new tab [3] Vendor/product page. https://www.balbooa.com/joomla-forms opens in a new tab
sourceCount: 3
| Date | Event | Description | Source |
|---|---|---|---|
| Jul 10, 2026 | First seen | First seen recorded for Balbooa Forms CVE-2026-56291 actively exploited vulnerability. | cisa.gov |
| Jul 10, 2026 | Discovery | Discovery recorded for Balbooa Forms CVE-2026-56291 actively exploited vulnerability. | cisa.gov |
| Jul 9, 2026 | Disclosure | Disclosure recorded for Balbooa Forms CVE-2026-56291 actively exploited vulnerability. | cisa.gov |
| Invalid Date | Patch or fix | Patch or fix recorded for Balbooa Forms CVE-2026-56291 actively exploited vulnerability. | cisa.gov |
| Jul 13, 2026 | kev due date | kev due date recorded for Balbooa Forms CVE-2026-56291 actively exploited vulnerability. | cisa.gov |
| Jul 10, 2026 | Balbooa Forms CVE-2026-56291 actively exploited vulnerability | Unknown | cisa.gov |
| Package | Ecosystem | Version Range | Status | Confidence | Source |
|---|---|---|---|---|---|
| balbooa-forms | enterprise-software | 1.0-2.4.0 | Malicious | 90% | cisa.gov; balbooa.com; nvd.nist.gov |
FormsBalbooaCVE-2026-56291| Title | Language | Description | Repository | Source |
|---|---|---|---|---|
| CVE-2026-56291 asset and telemetry scope | Python | Do asset inventories or exported telemetry contain CVE-2026-56291, Balbooa, Forms, or affected-version selectors? | scripts/scope_balbooa-forms-cve-2026-56291-kev.py opens in a new tab | cisa.gov |
#!/usr/bin/env python3
"""Scope CVE-2026-56291 exposure from asset inventories and exported Joomla/web telemetry.
Input: a directory containing CSV, JSON, JSONL, TXT, LOG, YAML, or XML exports.
The script does not contact the network. It looks for the CVE, vendor/product
selectors, and affected-version selectors recorded in the Halting Problems profile.
"""
from __future__ import annotations
import json, os, sys
from pathlib import Path
CVE_ID = "CVE-2026-56291"
VENDOR = "Balbooa"
PRODUCT = "Forms"
AFFECTED_VERSION_SELECTORS = [
"balbooa-forms 1.0-2.4.0"
]
SOURCE_SELECTORS = [
"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-56291",
"https://www.balbooa.com/joomla-forms",
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291"
]
DOMAINS = []
HASHES = []
URLS = []
FILES = []
PROCESS_PATTERNS = [PRODUCT, VENDOR, CVE_ID]
NETWORK_PATTERNS = []
INDICATORS = [CVE_ID, VENDOR, PRODUCT, *AFFECTED_VERSION_SELECTORS, *SOURCE_SELECTORS]
OUT = os.environ.get("OUT", "hp-balbooa-forms-cve-2026-56291-kev-scope")
TEXT_SUFFIXES = {'.csv','.json','.jsonl','.txt','.log','.yaml','.yml','.xml','.conf','.ini','.md'}
EXCLUDED_DIR_NAMES = {'.git','node_modules','vendor','dist','__pycache__','.venv'}
def read_text(path: Path) -> str:
try:
return path.read_text(encoding='utf-8', errors='ignore')
except Exception:
return ''
def iter_files(root: Path):
if root.is_file():
yield root; return
for p in root.rglob('*'):
if p.is_file() and not any(part in EXCLUDED_DIR_NAMES for part in p.parts):
if not p.suffix or p.suffix.lower() in TEXT_SUFFIXES:
yield p
def scan(root: Path):
matches=[]
lowered=[s.lower() for s in INDICATORS if s]
for path in iter_files(root):
text=read_text(path)
low=text.lower()
hits=sorted({INDICATORS[i] for i,s in enumerate(lowered) if s in low})
if hits:
matches.append({'path': str(path), 'hits': hits})
return matches
def main(argv=None):
argv=argv or sys.argv[1:]
root=Path(argv[0]) if argv else Path('.')
matches=scan(root)
out_dir=Path(OUT); out_dir.mkdir(parents=True, exist_ok=True)
report={'cve': CVE_ID, 'vendor': VENDOR, 'product': PRODUCT, 'affected_version_selectors': AFFECTED_VERSION_SELECTORS, 'match_count': len(matches), 'matches': matches}
(out_dir/'scope_report.json').write_text(json.dumps(report, indent=2), encoding='utf-8')
print(json.dumps({'cve': CVE_ID, 'match_count': len(matches), 'report': str(out_dir/'scope_report.json')}, indent=2))
return 2 if matches else 0
if __name__ == '__main__':
raise SystemExit(main())
| Source | Type | Reliability | Claims | Evidence |
|---|---|---|---|---|
| cisa.gov | Security Researcher | 95% | 2 | CISA KEV active-exploitation listing plus NVD/vendor/reference enrichment. |
| balbooa.com | Security Researcher | 95% | 1 | CISA KEV active-exploitation listing plus NVD/vendor/reference enrichment. |
| nvd.nist.gov | Security Researcher | 95% | 1 | CISA KEV active-exploitation listing plus NVD/vendor/reference enrichment. |