External risk intelligence

Joomla Fabrik Remote Code Execution via ajax_calc Plugin

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-66915

The vulnerability exists in a Joomla extension. Joomla is a web content management system typically deployed as a public-facing web application. Since this extension functions as a feature within a web-accessible application, it is commonly exposed to the internet in typical deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a Joomla extension that could allow an attacker to execute arbitrary code on affected systems. This issue stems from a feature within the extension that, when exploited, could lead to a complete compromise of the system. The main concern at this time is confirming if this extension is in use and if it is exposed to potential attackers.

Unauthenticated code execution in a Joomla extension.
Matters if your organization uses this extension.
Confirm if the extension is deployed and exposed.

Attack Path

How an attacker could exploit the issue

An attacker could execute arbitrary code by leveraging the `ajax_calc` feature within the Fabrik calc plugin. This vulnerability requires no authentication to trigger and can lead to the execution of malicious commands on the affected server.

No authentication needed.
Triggered via `ajax_calc` feature.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could exploit this vulnerability to execute arbitrary code on a Joomla site when supported by the advisory's conditions. This could impact the integrity and availability of the affected system.

System code execution is at risk.
Unauthenticated access via ajax_calc feature.
Compromise of site integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Fabrik extension for Joomla requires immediate attention from teams managing web applications and their components. The first practical step is to identify all Joomla instances using this extension, determine their exposure, and confirm business criticality. Subsequently, the accountable owner should be identified to plan and execute remediation, potentially involving vendor coordination or risk mitigation strategies.

Application owners and platform teams are responsible.
Verify Fabrik extension presence and reachability.
Plan vendor-assisted remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Fabrik extension for Joomla?

Fabrik is a powerful, open-source component for the Joomla content management system that allows users to create custom web applications, forms, and data visualizations without extensive programming. It acts as an extension that extends Joomla's standard capabilities, enabling developers to build complex database-driven tools directly within their websites.

How does CVE-2026-66915 allow code execution?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. It means the software does not properly filter or sanitize user input before passing it to a function that executes commands. Specifically, the Fabrik extension's 'ajax_calc' plugin feature allows an attacker to send crafted requests that the server interprets as instructions to run unauthorized commands.

Does this require special access to trigger?

No, this vulnerability does not require authentication. An attacker can attempt to reach the vulnerable 'ajax_calc' feature directly over the network without needing a username or password. Simply accessing the site normally or performing typical user activities does not trigger the bug; it requires specific, targeted requests sent to the affected component.

Is my site at risk if it uses Fabrik?

According to Halo Surface Signal, this vulnerability is considered a likely risk because Joomla sites are typically deployed as public-facing web applications. If your site is accessible from the internet, it is exposed to this flaw. You should prioritize assessing any instance where this extension is reachable by unauthorized external users.

How should I respond to this vulnerability?

Your first step is to perform an inventory of your Joomla environments to determine if the Fabrik extension is installed and active. Once you have identified all instances, assess whether those sites are internet-facing. After confirming presence and exposure, coordinate with your technical team to manage the risks and seek updates from the vendor to secure the component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.