Joomla! CMS CVE-2026-35222

Exploitation requires authentication as a high-privileged Joomla! user - specifically confirmed by the CVSS 4.0 vector PR:H and the vendor advisory title 'authenticated blind sqli in com_tags.' This means the attacker must already hold administrator-level access to the Joomla! backend, not merely a registered front-end account. The com_tags component must be active (it is enabled by default in standard Joomla! installations but may be disabled in hardened or stripped-down deployments). No user interaction is required beyond the attacker's own authenticated session (UI:N). Exploitation is limited to confidentiality impact only - the vulnerability cannot be used to modify or delete data, nor does it affect systems beyond the Joomla! CMS installation itself (SC:N/SI:N/SA:N). The blind nature of the injection means exploitation requires repeated, time-consuming requests and is not trivially automatable as a one-shot attack.

Real-world risk is moderate-to-low despite the broad version coverage, due to several limiting signals. The CVSS 4.0 score of 6.9 reflects the PR:H requirement (high-privilege authenticated access), which substantially constrains the attacker surface to compromised administrator accounts or malicious insiders. The scope is limited to the vulnerable system (SC:N/SI:N/SA:N), and impact is confined to confidentiality (VC:H) with no integrity or availability consequences - aligning with a read-only blind exfiltration scenario. EPSS at 0.00% (0th percentile) signals negligible opportunistic exploitation probability at time of analysis. There is no CISA KEV listing and no public exploit code identified. Taken together, this is a real vulnerability warranting patching in any standard patch cycle, but it does not represent an emergency priority unless the deployment involves high-privilege accounts held by untrusted parties (e.g., multi-tenant hosting environments, reseller panels, or delegated admin scenarios). The blind nature of the SQLi means successful exploitation requires sustained interaction and cannot be trivially automated.

An attacker who has obtained Joomla! administrator credentials - whether through phishing, credential stuffing, or a prior breach - navigates to a com_tags-accessible backend endpoint and submits a crafted request with a malicious ORDER BY parameter (e.g., a time-based payload like SLEEP(5) or a boolean expression). By systematically varying the injected condition and observing response timing or behavioral differences, the attacker iterates through the database schema and extracts sensitive data such as user credentials, email addresses, or site configuration values stored in the Joomla! database. No public exploit code has been identified at time of analysis, so exploitation currently requires manual crafting of blind injection payloads or adaptation of generic blind SQLi tooling (e.g., sqlmap) to this specific parameter.