Which versions of AcyMailing are affected by EUVD-2026-42591?

AcyMailing, a critical component of Joomla-based email marketing systems, contains a vulnerability allowing unauthenticated attackers to access organizational databases and exfiltrate sensitive…

Is there a public PoC exploit available for EUVD-2026-42591?

Yes, a public proof-of-concept exploit is available for EUVD-2026-42591. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-42591?

24 hours: Identify all Joomla instances running AcyMailing versions prior to 10.11.1; disable the extension on systems unable to patch immediately; enable database query logging. 7 days: Monitor vendor security advisories for AcyMailing patch releases; analyze database logs for exploitation attempts including anomalous SQL queries or unauthorized data access. 30 days: Deploy AcyMailing security patches immediately upon release; execute comprehensive Joomla extension security audit; implement WAF rules blocking SQL injection and enforce least-privilege database access controls.

AcyMailing EUVD-2026-42591

Q: What is the CVSS score of EUVD-2026-42591?

EUVD-2026-42591 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-56292 CRITICAL

SQL Injection (CWE-89)

2026-07-09 Joomla

GHSA-3m45-8387-4837

SQLi Acymailing Com Acymailing Extension For Joomla

9.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Network-reachable, unauthenticated SQLi (AV:N/PR:N/UI:N) with primarily data-disclosure impact (C:H) and limited integrity/availability effect; scope kept unchanged absent evidence of cross-system impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 14:45 vuln.today

CVE Published

Jul 09, 2026 - 13:49 cve.org

CRITICAL 9.2

DescriptionCVE.org

A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.

AnalysisAI

SQL injection in the AcyMailing newsletter/email-marketing extension for Joomla (all versions before 10.11.1) allows remote attackers to inject crafted database queries, resulting in unauthorized database access and data leakage. The high CVSS 4.0 score (9.2) reflects unauthenticated network reach and high confidentiality impact against the Joomla back-end database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a public disclosure write-up exists on mysites.guru.

Technical ContextAI

AcyMailing (CPE cpe:2.3:a:acymailing.com:acymailing.com_acymailing_extension_for_joomla) is one of the most widely used newsletter and email-marketing extensions for the Joomla CMS, handling subscriber lists, campaigns, and mail queues stored in the Joomla MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaches a SQL statement without proper parameterization or escaping, letting an attacker alter query logic. Because AcyMailing operates within Joomla's shared database, injected queries can potentially reach Joomla core tables (users, sessions, configuration) beyond the extension's own tables, which is consistent with the input's subsequent-system impact flags.

RemediationAI

Vendor-released patch: AcyMailing 10.11.1 - upgrade the extension to 10.11.1 or later, which resolves the SQL injection. Apply the update via the Joomla extension manager and confirm the installed AcyMailing version afterward. If immediate patching is not possible, restrict access to AcyMailing front-end and administrator endpoints (for example via web-application-firewall rules targeting SQLi patterns on AcyMailing controller parameters, or IP-restricting the Joomla administrator area), accepting that WAF rules may miss obfuscated payloads and that IP restrictions can break legitimate remote admin/subscriber workflows. Review database and web logs for anomalous queries against AcyMailing and Joomla core tables, and rotate Joomla credentials/secrets if compromise is suspected. Refer to the vendor site https://www.acymailing.com/ and the disclosure at https://mysites.guru/blog/acymailing-sql-injection-disclosure/ for release notes.