SPIP — unconditional pre-authentication RCE in all versions before 4.4.20, exploited in the wild; note 4.4.20 is itself affected by a second, unnumbered flaw fixed in 4.4.21

SPIP shipped two emergency releases in three days, each fixing an unconditional pre-authentication RCE the vendor says is already being exploited — and only the first one has a CVE

SPIP's maintainers published a critical security release on Monday 17 August 2026 and another on Thursday 20 August. The release notes describe their respective flaws in near-identical language, and the wording is unusually unhedged for a vendor bulletin: 4.4.20 fixes an unconditional, no-prerequisites pre-authentication remote code execution vulnerability affecting all versions of SPIP (SPIP, 2026-08-17), and 4.4.21 fixes an unconditional, no-prerequisites pre-authentication remote code execution vulnerability affecting version 4.4.20 — the release that had just shipped three days earlier (SPIP, 2026-08-20). Both notes then carry the same follow-on sentence word for word: the flaw is not handled by the security screen, it is imperative to update the site very quickly, and exploitation attempts have already been observed in the wild. The security screen — SPIP's own request-filtering layer, which many administrators treat as a standing compensating control against exactly this bug class — is therefore ruled out by the vendor as a mitigation for both. Both were reported anonymously through France's national cybersecurity agency, and the earlier one credits a researcher by handle for help with the analysis and the fix (SPIP, 2026-08-17).

Only the first of the two has an identifier. CVE-2026-77647 is the 4.4.20 fix: the EU vulnerability database record cites that release note directly, bounds the affected range as everything below 4.4.20, scores it CVSS 3.1 9.8 with an EPSS of 0.82, and states in its own description that the flaw is exploited in the wild in August 2026 (ENISA EU Vulnerability Database, 2026-08-20). Its published root cause is incorrect identification of PHP open tags combined with a value-exporting function's mishandling of certain cases such as the presence of a < character (ENISA EU Vulnerability Database, 2026-08-20). The 4.4.21 flaw has no CVE, no CWE and no published root cause; CERT-FR relayed it as an advisory the following day, recording remote code execution as the risk, giving the affected range as all versions before 4.4.21, and attributing the active-exploitation statement to the vendor rather than asserting it itself (CERT-FR, 2026-08-21). Whether it is a bypass of the fix that shipped three days earlier or an independent flaw of the same shape is not something any source says, and this entry does not guess.

Triage: a public CMS receives constant automated probing, so request volume and 404 noise separate nothing. The discriminator is what happens after a request rather than the request itself — a web-server worker process spawning a shell or interpreter child, or a file appearing under the document root whose modification time matches no deployment, upgrade or editorial action. On a platform this widely deployed across French-language public administration, and with the earlier flaw's CVE record already recording in-the-wild exploitation, the base rate for that sequence being benign is low.