--- schema: 1 kind: vulnerability title: "Ghost CMS CVE-2026-26980 → ClickFix: the CMS-compromise-to-endpoint kill chain" headline: "Ghost CMS CVE-2026-26980 → ClickFix: the CMS-compromise-to-endpoint kill chain" summary: "Background. CVE-2026-26980 was disclosed and patched in Ghost 6.19.1 on 19 February 2026, and SentinelOne reported in-the-wild exploitation and detection guidance by 27 February (BleepingComputer, 2026-05-24)." discovered_at: "2026-05-25T05:00:04Z" event_date: 2026-05-24 run_id: 2026-05-25-d675ef38 priority: notable immediate_action: null tags: - vulnerabilities - actively-exploited - pre-auth - info-disclosure - phishing - infostealer regions: - global - europe sectors: - education - media - technology - public-sector entities: [] cves: - id: CVE-2026-26980 cvss: "9.4" epss: null type: info-disclosure vector: zero-click auth: pre-auth status: - exploited - patch-available sources: - url: "https://github.com/advisories/GHSA-w52v-v783-gw97" publisher: GitHub Security Advisory GHSA-w52v-v783-gw97 role: primary - url: "https://blog.xlab.qianxin.com/ghost-cms-mass-compromised-via-cve-2026-26980-now-fueling-clickfix-attacks/" publisher: "XLab Qianxin, 2026-05-21" role: corroborating - url: "https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/" publisher: "BleepingComputer, 2026-05-24" role: corroborating closed_sources: [] evidence: - quote: Background. publisher: ctipilot v2 brief (migrated) verification: multi-source sourcing_note: "migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)" confidence: high update_of: null references: [] deep_dive: true deep_dive_category: other org_triage: null watchlist_hit: false actions: [] migrated_from: briefs/2026-05-25.md --- **Background.** CVE-2026-26980 was disclosed and patched in Ghost 6.19.1 on 19 February 2026, and SentinelOne reported in-the-wild exploitation and detection guidance by 27 February ([BleepingComputer, 2026-05-24](https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/)). The May activity XLab documented is not a new bug but a large-scale weaponisation of the unpatched long tail of self-hosted instances, repurposing compromised editorial sites as a high-traffic, low-attributable delivery surface for ClickFix social engineering ([XLab Qianxin, 2026-05-21](https://blog.xlab.qianxin.com/ghost-cms-mass-compromised-via-cve-2026-26980-now-fueling-clickfix-attacks/)). ClickFix / FakeCaptcha — tricking a user into pasting an attacker-supplied command into the Run dialog or a terminal — has been a tracked initial-access technique since 2024; what is notable here is the combination of a CVSS-9.4 pre-auth CMS flaw as the distribution mechanism with a fingerprinting/cloaking stage that keeps the lure invisible to non-targets and to casual review. **Kill chain → MITRE ATT&CK.** - **Initial access — [`T1190`](https://attack.mitre.org/techniques/T1190/) Exploit Public-Facing Application.** Unauthenticated boolean-based blind SQL injection through the Content API's `slug` filter parameter. No credentials, no user interaction — the request pattern the vendor mitigation keys on is a query string containing `slug:[` (`slug%3A%5B`). - **Credential access — [`T1552`](https://attack.mitre.org/techniques/T1552/) Unsecured Credentials.** The injection is used to read the **admin API key** out of Ghost's database. This key is a bearer token with full content-management scope, so its theft is the privilege pivot — there is no separate authentication step after extraction. - **Content injection / defacement — [`T1659`](https://attack.mitre.org/techniques/T1659/) Content Injection.** With the admin key the attacker injects a lightweight JavaScript loader into published articles and/or theme templates, so the malicious code is served to every visitor from the site's own trusted origin. - **Execution-guardrails cloaking — [`T1480`](https://attack.mitre.org/techniques/T1480/) Execution Guardrails.** The loader fetches a second-stage cloaking script that fingerprints each visitor and only proceeds for those matching the target profile (e.g. Windows desktop), so most visitors and most analysts never see the lure. - **User execution — [`T1204.002`](https://attack.mitre.org/techniques/T1204/002/) User Execution: Malicious File, chained to [`T1059.001`](https://attack.mitre.org/techniques/T1059/001/) PowerShell / [`T1059.003`](https://attack.mitre.org/techniques/T1059/003/) Windows Command Shell.** Qualifying visitors are shown a fake Cloudflare "verify you are human" prompt in an overlay iframe instructing them to paste a supplied command into the Windows Run dialog (`Win+R`) or a terminal. - **Payload delivery — [`T1105`](https://attack.mitre.org/techniques/T1105/) Ingress Tool Transfer.** The pasted command pulls follow-on payloads; XLab observed DLL loaders, JavaScript droppers, and an Electron-based sample named `UtilifySetup.exe`, leading to info-stealer / RAT capability. **Detection concepts (no IOCs).** Two distinct hunt surfaces: - *Server-side, for Ghost operators.* Review web-server / reverse-proxy access logs for Content API requests to `/ghost/api/content/` whose `filter`/`slug` parameter contains `slug:[` (`slug%3A%5B`) or boolean-blind SQL artefacts (`AND`, `CASE`, time-delay primitives) — the vendor mitigation pattern is the highest-fidelity signal. In the Ghost admin audit trail, alert on unexpected article or theme modifications, and on any `