Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign
Summary
A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited in a widespread campaign. Attackers are injecting malicious JavaScript code to initiate ClickFix attack flows, impacting a large number of websites.
IFF Assessment
FOE
The exploitation of a SQL injection vulnerability leads to potential compromise and malicious activity on affected websites.
Severity
9.4
Critical
Defender Context
Defenders using Ghost CMS should immediately apply the necessary patches or mitigations for CVE-2026-26980. Web application firewalls (WAFs) can be configured to detect and block SQL injection attempts. Regular security audits and vulnerability scanning are crucial for identifying and addressing potential weaknesses in content management systems.