Vulnerabilitycritical
Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-26980 | Unauthenticated SQL Injection in Ghost CMS Allows Arbitrary Database Reads | 7.5 | 70% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | clo4shara.xyz | eving the main payload at runtime from an external domain ("clo4shara[.]xyz/11z77u3.php"). This architecture offers added flexibility |
| domain | com-apps.cc | ported C2 domains named "restrictes[.]com/11z77u3.php" and "com-apps[.]cc/11z77u3.php" (instead of "clo4shara[.]xyz/11z77u3.php"), |
| domain | restrictes.com | ection point to two previously unreported C2 domains named "restrictes[.]com/11z77u3.php" and "com-apps[.]cc/11z77u3.php" (instead of |
| domain | web-telegram.ug | designed to achieve persistence and poll a remote server ("web-telegram[.]ug") every 30 seconds to process instructions issued by the |
From the original article
4 min read at thehackernews.com
Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks. According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9. 4), an SQL injection vulnerability in Ghost's Content API that could allow an unauthenticated attacker to read arbitrary data from the database.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.