Open-source business platforms week 40 2026: Joomla! SSRF and MFA bypass lead 30 vulnerabilities

The release at a glance

During week 40 of 2026 (28 September – 4 October), the maintainers of Joomla!, Moodle and Frappe / ERPNext published 30 vulnerabilities. Of these, 28 have CVE identifiers and two are GitHub security advisories without CVE ids. By severity, the release includes seven high, eighteen medium, four low and one unscored item. By product, Joomla! accounts for 16, Moodle for 12, and Frappe / ERPNext for 2. None of the vulnerabilities is listed in CISA KEV and none is reported as exploited.

What matters most

Joomla! CMS dominates the high-severity set. CVE-2026-92222 is a server-side request forgery in core extensions (CVSS 8.9) caused by improper validation of URLs used for server-side requests; it is fixed in Joomla! CMS 5.4.9 and 6.1.4. CVE-2026-92227 is an MFA bypass through premature issuance of a remember-me cookie (CVSS 8.2), reachable over the network without credentials and fixed in the same releases. Two InputFilter XSS filter bypasses, CVE-2026-92232 and CVE-2026-92231 (both CVSS 7.1), affect Joomla! CMS and the Joomla! Framework Filter package. CVE-2026-90913 and CVE-2026-92226 are improper ACL checks in web service endpoints, allowing unauthorised mutation or edit actions (CVSS 7.0). CVE-2026-90915 is a path traversal in the cache purge action that can delete arbitrary directories (CVSS 7.0). The Joomla! fixes for these are Joomla! CMS 5.4.9 and 6.1.4.

Moodle: CVE-2026-102588 is a Cross-Site Request Forgery flaw in the XML grade import feature (CVSS 6.5). An attacker who tricks an authenticated user with grade management permissions into visiting a malicious page can set or overwrite student grades. Fixed versions are Moodle 5.2.2, 5.1.6, 5.0.9, and 4.5.13.

Patch in this order

1. Patch Joomla! CMS first. If you are on 4.0.0 through 5.4.8, move to 5.4.9; if you are on 6.0.0 through 6.1.3, move to 6.1.4. This addresses the SSRF, MFA bypass, XSS filter bypasses, ACL web service issues and directory deletion detailed above.
2. Patch Moodle next. Apply 5.2.2, 5.1.6, 5.0.9 or 4.5.13 depending on your branch to address CVE-2026-102588.
3. Review any direct use of the Joomla! Framework Filter package. The InputFilter bypasses above also affect that package, so confirm the appropriate package update from the Joomla! advisory.
4. Work through the remaining Joomla!, Moodle and Frappe / ERPNext medium and low items after the high-severity fixes are in. No CISA KEV or exploited status applies to this set, but internet-facing Joomla! and Moodle deployments should be prioritised over internal-only instances.

Beyond the patch

These releases become routine when you know which open-source platforms you expose and how quickly their maintainers ship fixes. An Implementation & Assessment Services penetration test or hardening review is the most direct way to validate a public Joomla!, Moodle or Frappe deployment, while Virtual CISO Services helps keep the externally reachable issues in this set prioritised week to week. Supply Chain Defense & Third-Party Risk is useful for tracking how the maintainers of these platforms patch and where gaps between upstream fixes and your installed versions can arise.