Sploitus

Critical RCE Vulnerability in Craft CMS Exploited

First seen 27 Sep 2026, 20:58 UTC • •72.6

Article Content

1 / 3

Browse articles

ThreatCluster •September 27, 2026 at 21:57 UTC

•Authenticated RCE vulnerability affects Craft CMS ≤ 5.9.8.
•Bypasses CVE-2026-28695 patch restricting object creation.
•Active exploitation confirmed with public proof-of-concept code.

A newly discovered exploit allows authenticated blind remote code execution (RCE) in Craft CMS versions up to 5.9.8, bypassing the CVE-2026-28695 fix. The vulnerability arises from improper neutralization of special elements in a template engine, specifically through the `create()` method, which was meant to restrict object instantiation to `BaseObject` subclasses. Attackers can leverage this flaw using a crafted payload to execute arbitrary commands on the server. The exploit is confirmed to be active as of September 27, 2026, with proof-of-concept code publicly available. This vulnerability affects all installations of Craft CMS that have not been updated beyond version 5.9.8. Security professionals are urged to assess their systems and apply necessary mitigations immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-03-04

CVE-2026-28695 published

Craft CMS disclosed a vulnerability allowing server-side template injection leading to RCE.

2026-09-27

Exploit for CVE-2026-28695 bypass published

A new exploit bypassing the CVE-2026-28695 fix was made public, demonstrating RCE capabilities.

2026-09-27

Active exploitation confirmed

Reports indicate that the exploit is being actively used in the wild against vulnerable Craft CMS installations.

More articles in this cluster (2)

Threat Graph

8 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Remote Code Execution
Zero-day Exploit
T1059.004 - Unix Shell

Vulnerability (1)

CVE-2026-28695

Weakness (1)

Cwe-502 - Deserialization Of Untrusted Data

Affected Platform (2)

Craft CMS
PHP

Tool (1)

Socat

Relationships

Socat exploits CVE-2026-28695
CVE-2026-28695 targets Craft CMS
CVE-2026-28695 targets PHP
Remote Code Execution targets Craft CMS
Remote Code Execution targets PHP
Zero-day Exploit targets Craft CMS
Zero-day Exploit targets PHP
T1059.004 - Unix Shell targets Craft CMS
T1059.004 - Unix Shell targets PHP
CVE-2026-28695 related to Cwe-502 - Deserialization Of Untrusted Data

Following this threat?

Track CVE-2026-28695 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This…