Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

A critical SQL injection vulnerability, tracked as CVE-2026-26980, in Ghost CMS is being actively exploited by attackers in a large-scale campaign to inject malicious JavaScript code, triggering ClickFix attack flows¹. This vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized access and data breaches. The exploitation of this flaw is particularly concerning, as it enables attackers to bypass security measures and inject malicious code, compromising the security of affected systems. The campaign's scope and scale suggest that attackers are aggressively targeting vulnerable Ghost CMS installations, emphasizing the need for prompt patching and mitigation. As the disclosure of CVE-2026-26980 expands the active attack surface, practitioners must prioritize their response based on exposure and exploitation evidence. The exploitation of this vulnerability has significant implications for security teams, who must take immediate action to protect against potential attacks.