CVE-2026-26980 -- CVSS 9.4 Vulnerability Briefing

CVE-2026-26980 | CVSS 9.4 (Critical) | Exploit: PoC available

What Is It

CVE-2026-26980 is an unauthenticated database read vulnerability in Ghost, a Node.js-based content management system, affecting versions 3.24.0 through 6.19.0.

Technical Detail

The flaw permits unauthenticated remote attackers to perform arbitrary read operations against the underlying Ghost database without any credentials or prior access. The exact mechanism has not been fully disclosed, but the vulnerability is reachable through the application's public-facing interface, requiring no authentication to trigger. Successful exploitation could expose sensitive database contents including user credentials, private post content, configuration data, and other stored application data.

Exploitation Status

A proof-of-concept exploit is publicly available. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and there is no confirmed evidence of active in-the-wild exploitation at this time. However, the availability of a PoC combined with the critical CVSS score of 9.4 and the unauthenticated attack vector meaningfully lowers the barrier for exploitation by less sophisticated actors.

Who Is Targeting This

No specific threat actor attribution at this time. No confirmed or reported threat actor activity has been associated with this vulnerability.

What To Do

Upgrade to Ghost version 6.19.1 or later immediately, as this is the only confirmed fix. Organizations running any Ghost instance from version 3.24.0 through 6.19.0 should treat this as a priority patch given the critical severity rating and unauthenticated attack surface. If immediate patching is not possible, restrict public network access to Ghost instances at the perimeter level as a temporary measure. Review database access logs for anomalous or unexpected query patterns that may indicate prior exploitation. Given the PoC availability, assume the window before opportunistic scanning begins is short and prioritize remediation accordingly.