Craft CMS — Cyber Threats, Attacks & Incidents

Related Threat Clusters

• Critical RCE Vulnerability in Craft CMS (CVE-2026-31857) Exposed

  A Remote Code Execution vulnerability (CVE-2026-31857) has been identified in Craft CMS versions prior to 5.9.9 and 4.17.4. The flaw exists in the BaseElementSelectConditionRule::getElementIds() method, which improperly…

  2 articles · Updated April 12, 2026
• ACSC Issues Critical Alert on Exploited CMS Vulnerabilities

  The Australian Cyber Security Centre (ACSC) has issued a second alert in two months regarding a large-scale hacking campaign exploiting unpatched vulnerabilities in content management systems (CMS). The campaign targets…

  10 articles · Updated July 9, 2026
• Craft CMS Vulnerability CVE-2026-55794 Allows Authenticated RCE via HTTP Referrer

  Craft CMS versions 5.9.0 and above prior to 5.10.0 are vulnerable to authenticated remote code execution (RCE) due to a flaw in how the control panel processes the HTTP Referrer header. Users with edit permissions can…

  2 articles · Updated July 7, 2026

Recent Intelligence Reports

• Second alert from ACSC in two months shows unpatched CMS bugs still exploited — Itnews.Au · July 9, 2026
• nvd.nist.gov /vuln/detail/CVE-2026-55794 — nvd.nist.gov · July 7, 2026
• CVE-2026-55794: Craft CMS: Potential authenticated Remote Code Execution via referrer redirect — Advisories.Gitlab · July 7, 2026
• CVE-2026-31857 — nvd.nist.gov · April 12, 2026
• Craft CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-31857) — Acunetix · April 12, 2026

Related Entities