Australian Cyber Security Centre Issues Alert on Mass Exploitation of CMS Vulnerabilities

The Australian Cyber Security Centre (ACSC) issued a critical alert on July 11, 2026, about a global cyberattack campaign exploiting known, patched vulnerabilities in Content Management Systems (CMS) and plugins. Threat actors are mass-scanning for unpatched websites to install webshells, enabling server compromise, data theft, and potential ransomware. The ACSC noted that AI may be accelerating attackers' ability to weaponize newly disclosed vulnerabilities, reducing the window for defenders to patch.

Originally published on CyberNetSec. On July 11, 2026, the Australian Cyber Security Centre ACSC released a critical alert detailing a large-scale, global cyberattack campaign. Threat actors are systematically exploiting a wide range of known, patched vulnerabilities in popular Content Management Systems CMS and their associated plugins. The primary targets include The campaign is characterized by its broad scope and reliance on exploiting old, unpatched vulnerabilities. Attackers are conducting mass scanning operations to identify internet-facing websites running vulnerable versions of CMS platforms or plugins. Once a target is identified, the attackers exploit a known flaw to achieve initial access, with the end goal of uploading a webshell. A webshell provides a backdoor, allowing the attacker to execute commands on the server, manipulate files, and access databases. This access is then used for various malicious purposes: The ACSC noted that the use of AI by threat actors may be accelerating their ability to weaponize newly disclosed vulnerabilities, shortening the window for defenders to patch. The campaign leverages a list of 17 specific vulnerabilities. The exploitation of these flaws falls under the MITRE ATT&CK technique T1190 - Exploit Public-Facing Application https://attack.mitre.org/techniques/T1190/ . The ultimate goal is the installation of a webshell, which corresponds to T1505.003 - Server Software Component: Web Shell The targeted vulnerabilities include, but are not limited to: CVE-2026-1357 , Ninja Forms CVE-2026-3844 , Breeze Cache CVE-2026-1969 , Gravity Forms CVE-2025-12352 , and others. CVE-2026-0740 . CVE-2025-34085 , MaxSite CMS CVE-2020-36847 , and MetInfo CMS CVE-2025-7852 .These vulnerabilities range from unauthenticated file uploads to remote code execution and server-side request forgery SSRF . The fact that many of these have had patches available for months or years indicates a systemic failure in patch management across many organizations. The impact on a compromised organization can be severe. A public-facing website is often the gateway to an organization's digital presence. A breach can lead to significant reputational damage from website defacement or data leaks. The theft of customer data can result in regulatory fines and loss of trust. If the compromised web server is used as a pivot point into the internal network, it can lead to a full-scale enterprise breach, potentially culminating in a ransomware attack. For small and medium businesses with limited security resources, recovering from such an attack can be financially devastating. No specific webshell hashes, IP addresses, or C2 domains were mentioned in the source articles. Security teams should proactively hunt for signs of compromise related to this campaign: | Type | Value | Description | |---|---|---| | url pattern | /wp-content/plugins/ / | Look for suspicious POST requests to plugin directories, especially for file uploads .php , .phtml . | | file name | .php | Search for recently created or modified PHP files in unexpected locations, such as image upload directories. | | log source | Web Server Access Logs | Scrutinize logs for requests to known vulnerable endpoints associated with the listed CVEs. Look for unusual user agents or requests from a single IP hitting multiple non-existent pages. | | command line pattern | curl | wget http:///.sh | .php . .jpg file that is later executed . This is an application of D3-NTA - Network Traffic Analysis The most critical mitigation is timely patch management. M1051 - Update Software M1022 - Restrict File and Directory Permissions M1030 - Network Segmentation