Ghost CMS SQL Injection CVE-2026-26980: ClickFix Campaign Hits 700+ Domains

A large-scale campaign is actively exploiting a critical SQL injection vulnerability in Ghost CMS to inject malicious JavaScript that drives ClickFix attack flows. The campaign has already compromised more than 700 domains, including university portals, AI companies, and major media outlets. Security researchers at Qianxin XLab discovered the attacks. They warn that many site owners have not yet applied the February patch.

What Happened: Ghost CMS CVE-2026-26980 Under Active Exploitation

On February 19, 2026, Ghost CMS released version 6.19.1 to fix CVE-2026-26980, a critical SQL injection flaw in the platform’s content management API. The vulnerability allows unauthenticated attackers to read arbitrary data from the website database, including sensitive admin API keys. SentinelOne published exploitation details on February 27, and by May 2026, XLab confirmed a coordinated campaign targeting vulnerable sites worldwide.

The attackers have successfully compromised high-profile domains. According to XLab, affected sites include Harvard University, Oxford University, Auburn University, and DuckDuckGo. The attackers plant malicious JavaScript into articles that serves a fake Cloudflare verification prompt. This lure tricks visitors into pasting a command into their Windows command prompt. Consequently, the victim unknowingly installs malware on their system.

Technical Details of the Ghost CMS SQL Injection Attack

CVE-2026-26980 exists in Ghost CMS versions 3.24.0 through 6.19.0. The flaw stems from insufficient input sanitization in the platform’s database abstraction layer. An unauthenticated attacker can inject malicious SQL commands to extract data directly from the backend database.

Attack Chain

The observed attack chain follows a clear multi-stage pattern:

1. SQL Injection: The attacker exploits CVE-2026-26980 to extract the admin API key from the Ghost database.
2. Code Injection: Using the stolen API key, the attacker injects a lightweight JavaScript loader into published articles.
3. Cloaking and Fingerprinting: The loader fetches a second-stage cloaking script that fingerprints visitors to filter targets.
4. ClickFix Lure: Qualifying visitors see a fake Cloudflare human verification prompt loaded via iframe.
5. Payload Delivery: The prompt instructs the user to paste a command into their command prompt. This drops the final payload.

Observed Payloads

XLab has identified multiple payloads in these attacks. The malware types include:

• DLL loaders used to stage additional malware
• JavaScript droppers that fetch and execute secondary payloads
• UtilifySetup.exe, an Electron-based malware sample packaged as a legitimate utility

Researchers also observed competitive behavior among threat actors. Some domains were re-infected multiple times after cleanup. In several cases, one attacker removed a competitor’s script before injecting their own.

Business and Operational Impact

The Ghost CMS exploitation campaign carries significant consequences for both website operators and their visitors. The impact spans multiple categories:

• Website Compromise: Over 700 confirmed compromised domains, including trusted institutions and technology companies.
• Visitor Infection: End users who follow the ClickFix lure unknowingly install malware on their personal or corporate devices.
• Reputational Damage: High-profile brands and universities face erosion of public trust when their sites serve malicious content.
• Credential Exposure: Stolen admin API keys can be used to modify themes, exfiltrate subscriber data, or pivot into internal systems.
• Supply Chain Risk: Ghost CMS powers independent publishers, SaaS platforms, and media sites that serve as downstream content sources.

Mitigation and Recommendations

Ghost CMS administrators must act immediately to limit exposure. The most critical step is patching, but additional hardening measures are essential.

Immediate Actions for Defenders

1. Upgrade Ghost CMS immediately. Apply version 6.19.1 or later through the Ghost admin panel or command-line updater.
2. Rotate all API keys. Any admin API keys created before patching may have been exposed. Generate new keys and revoke the old ones.
3. Audit injected scripts. Review all published posts, pages, and theme files for unauthorized JavaScript. Remove any suspicious loaders or iframe injections.
4. Review admin API logs. Maintain a 30-day record of admin API calls to support retrospective investigation of unauthorized access.
5. Scan visitor-facing content. Use browser developer tools or external scanning services to verify that no malicious scripts remain active on the site.
6. Notify affected users. If visitor data may have been exposed, issue breach notifications in accordance with applicable regulations.

Long-Term Hardening Strategies

Beyond immediate remediation, organizations should implement layered defenses. Keep Ghost CMS and all dependencies updated on a regular schedule. Use web application firewalls to filter suspicious database query patterns. Furthermore, restrict admin API access to trusted IP ranges where possible. Finally, monitor threat intelligence feeds for emerging exploitation tactics targeting content management systems.

Bottom line: CVE-2026-26980 is being actively exploited at scale against Ghost CMS sites that missed the February patch. With over 700 domains compromised and high-profile institutions affected, immediate patching and key rotation are non-negotiable.

Incident Summary

CVE ID / Incident:	CVE-2026-26980 (NVD)
Affected Systems:	Ghost CMS versions 3.24.0 through 6.19.0
Disclosure Date:	February 19, 2026
Patch Status:	Fixed in Ghost CMS 6.19.1 and later
Exploitation Status:	Actively exploited in large-scale ClickFix campaign (confirmed May 2026)
Confirmed Victims:	700+ domains including Harvard, Oxford, Auburn, DuckDuckGo

References

1. Sergiu Gatlan, “Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign,” BleepingComputer, May 24, 2026, https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/, accessed May 24, 2026.
2. SentinelOne, “CVE-2026-26980,” SentinelOne Vulnerability Database, February 27, 2026, https://www.sentinelone.com/vulnerability-database/cve-2026-26980/, accessed May 24, 2026.
3. TryGhost, “GHSA-w52v-v783-gw97,” GitHub Security Advisory, February 19, 2026, https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97, accessed May 24, 2026.
4. National Vulnerability Database, “CVE-2026-26980,” NIST, https://nvd.nist.gov/vuln/detail/CVE-2026-26980, accessed May 24, 2026.
5. Ars Technica, “Google publishes exploit code threatening millions of Chromium users,” Ars Technica, May 21, 2026, https://arstechnica.com/security/2026/05/google-publishes-exploit-code-threatening-millions-of-chromium-users/, accessed May 24, 2026.