Critical Alert CVE-2026-26980 in Ghost CMS exposes Admin API and facilitates JavaScript loaders in hundreds of sites

A critical failure in Ghost CMS - registered as CVE-2026-26980 and valued with a CVSS 9.4- is being exploited in mass campaigns that insert malicious JavaScript code into legitimate sites to facilitate ClickFix-type attacks, according to public investigations and intelligence reports. Vulnerability, a SQL injection error in the API Content resolved in February 2026 in the version 6.19.1, allows an unauthenticated attacker to read arbitrary database data and, crucially, to recover the Admin API key from an unauthorized Ghost site.

The real danger of this weakness is not only the exfiltration of data, but the ability to modify published content: with the management key a malicious actor can invoke the Admin API and edit block articles to inject a loader JavaScript at the end of the pages. That loader is a deliberately fine piece: download in running time a main payload hosted in external domains, allowing the attacker to change malware without recompromising each site individually.

The behind-the-campaign operators have used a commercial landing script known as Adspect to distinguish between legitimate visitors and scanners, giving only selected victims a false CAPTCHA verification within an iframe that orders the user to run a Base64 command in the Windows Run dialog. That chain triggers a fall chain that can end up installing executables (for example, a DLL released with rundl32 or an Inno Setup installer containing a modified Grape client), providing persistence and a remote control channel.

The scale is worrying: QiAnXin XLab assigns the campaign to at least two different clusters, with commitments that in some cases occurred in less than 24 hours since initial detection on 7 May 2026, and more than 700 affected sites in sectors including universities, blockchain, IA, SaaS, security research, media and fintech. The use of legitimate sites increases the rate of success of deception because users rely more on institutional domains to follow instructions or complete apparently harmless forms.

To mitigate the immediate risk, primary action is to apply patches: update Ghost to version 6.19.1 or more and verify that there are no unupdated instances. In addition, it is essential to rotate all the credentials and keys of the Admin API, invalidating old tokens, and to review the integrity of the published content to remove the loaders and any embedded remote code. The official documentation of Ghost and his update guides are a reliable starting point: https: / / ghost.org / docs /.

The affected organizations should keep records and evidence before they clean up and perform a forensic analysis: preserve web access logs, database records and system snapshots to draw range, input vectors and possible exfiltrations. Audit hosting settings and privileged users, and review integrations such as webhooks or automated processes that may have been manipulated. For technical details and vulnerability reference, the NIST / NVD record contains the CVE sheet: https: / / nvd.nist.gov / vuln / detail / CVE-2026-26980.

At the preventive level, implement compensatory controls to reduce the impact of future failures: restrict access to administrative APIs by IP or VPN, implement policies of least privilege in keys and accounts, enable Content Security Policy (CSP) to limit the execution of external scripts, and use a WAF with specific rules for SQL injection and blocking of tampering patterns in HTML. Network egress should also be limited from web servers to prevent external payload downloads.

Finally, report proactively: if your site was compromised, notify users who may have interacted with altered content to monitor devices and are attentive to commitment indicators (such as unsolicited facilities or unusual requests). If you find artifacts related to domains such as the one mentioned by the researchers, document the evidence and consider coordinating with incident response teams and authorities according to the applicable legal framework.

The exploitation of CVE-2026-26980 highlights a recurring reality in web security: widely adopted CMS become very attractive vectors for attackers because a single failure can amplify the impact on thousands of users. Parches, credentials rotation, monitoring and continuous access controls are the measures that significantly reduce this risk.