CVE-2026-86730: cms authenticated RCE

CISO Take

Craft CMS versions before 5.10.12 fail to sanitize string-typed field-layout elements, letting an already-authenticated control-panel user smuggle Yii2 behavior attachments and event handlers through the field-layout tab JSON, which Craft::createObject() then instantiates into arbitrary code execution on the server. This is a generic PHP CMS vulnerability, not an AI/ML-specific flaw — Craft CMS does not appear in our tracked AI/ML package catalog, so treat this as infrastructure risk rather than an AI supply-chain or model-serving issue; it only matters to AI-focused teams if Craft CMS happens to host a marketing site, docs portal, or admin panel adjacent to AI infrastructure. The CVSS 8.8 (network, low complexity, no user interaction) is serious but requires an authenticated, low-privilege control-panel account first, which meaningfully narrows the exploitation surface; there is no CISA KEV listing, no known public exploit, and no Nuclei template, and EPSS data is unavailable, so there is no evidence of active or imminent mass exploitation. Action: patch to Craft CMS 5.10.12 or later immediately, audit control-panel user accounts and permissions to reduce the pool of accounts that could stage this attack, and review recent field-layout changes and server process logs for unexpected object instantiation or outbound connections as a compromise indicator.

Sources: NVD GitHub Advisory vulncheck.com

What is the risk?

Severity is high (CVSS 8.8) with network attack vector, low complexity, and no user interaction required for the exploitation step itself, but the privilege-required (PR:L) precondition means an attacker needs a valid, even low-privileged, Craft CMS control-panel account before they can trigger the object-instantiation chain. No CISA KEV listing, no confirmed public exploit code, and no Nuclei scanner template exist as of publication, and EPSS is not available — so likelihood of imminent mass exploitation is currently unconfirmed rather than demonstrated. The realistic risk path is credential compromise (phishing, credential stuffing, insider misuse) of a low-priv CMS account followed by RCE, which then yields full compromise (confidentiality/integrity/availability all rated High) of the underlying host.

How does the attack unfold?

Initial Access

Attacker obtains valid low-privilege Craft CMS control-panel credentials through phishing, credential stuffing, or insider access.

Payload Crafting

Attacker posts a field-layout tab element as a JSON string embedding a malicious Yii2 behavior attachment or event handler, bypassing cleanse validation.

Exploitation

Craft::createObject() processes the field-layout data and instantiates the attacker-controlled object, triggering arbitrary code execution.

AML.T0049

Impact

Attacker achieves full compromise of confidentiality, integrity, and availability on the underlying server hosting Craft CMS.

Initial Access

Attacker obtains valid low-privilege Craft CMS control-panel credentials through phishing, credential stuffing, or insider access.

Payload Crafting

Attacker posts a field-layout tab element as a JSON string embedding a malicious Yii2 behavior attachment or event handler, bypassing cleanse validation.

Exploitation

Craft::createObject() processes the field-layout data and instantiates the attacker-controlled object, triggering arbitrary code execution.

AML.T0049

Impact

Attacker achieves full compromise of confidentiality, integrity, and availability on the underlying server hosting Craft CMS.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
cms	—	—	No patch

Do you use cms? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade all Craft CMS instances to version 5.10.12 or later immediately — this is the vendor-confirmed fix per GHSA-qj4v-m29p-fj4m. Until patched, restrict control-panel access to a minimal, tightly audited set of trusted accounts and enforce MFA on all control-panel logins to reduce the chance an attacker obtains the low-privilege foothold this exploit requires. Review field-layout tab configurations and recent edits for unexpected JSON-string content or unfamiliar class references, and monitor application/server logs for anomalous Craft::createObject() behavior, unexpected outbound connections, or new scheduled tasks/processes following control-panel activity. Segment any Craft CMS hosts away from sensitive internal systems (including AI infrastructure) as defense in depth given the High/High/High impact rating.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Framework AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.2 - Third-party and supplier management

Frequently Asked Questions

What is CVE-2026-86730?

Craft CMS versions before 5.10.12 fail to sanitize string-typed field-layout elements, letting an already-authenticated control-panel user smuggle Yii2 behavior attachments and event handlers through the field-layout tab JSON, which Craft::createObject() then instantiates into arbitrary code execution on the server. This is a generic PHP CMS vulnerability, not an AI/ML-specific flaw — Craft CMS does not appear in our tracked AI/ML package catalog, so treat this as infrastructure risk rather than an AI supply-chain or model-serving issue; it only matters to AI-focused teams if Craft CMS happens to host a marketing site, docs portal, or admin panel adjacent to AI infrastructure. The CVSS 8.8 (network, low complexity, no user interaction) is serious but requires an authenticated, low-privilege control-panel account first, which meaningfully narrows the exploitation surface; there is no CISA KEV listing, no known public exploit, and no Nuclei template, and EPSS data is unavailable, so there is no evidence of active or imminent mass exploitation. Action: patch to Craft CMS 5.10.12 or later immediately, audit control-panel user accounts and permissions to reduce the pool of accounts that could stage this attack, and review recent field-layout changes and server process logs for unexpected object instantiation or outbound connections as a compromise indicator.

Is CVE-2026-86730 actively exploited?

No confirmed active exploitation of CVE-2026-86730 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86730?

Upgrade all Craft CMS instances to version 5.10.12 or later immediately — this is the vendor-confirmed fix per GHSA-qj4v-m29p-fj4m. Until patched, restrict control-panel access to a minimal, tightly audited set of trusted accounts and enforce MFA on all control-panel logins to reduce the chance an attacker obtains the low-privilege foothold this exploit requires. Review field-layout tab configurations and recent edits for unexpected JSON-string content or unfamiliar class references, and monitor application/server logs for anomalous Craft::createObject() behavior, unexpected outbound connections, or new scheduled tasks/processes following control-panel activity. Segment any Craft CMS hosts away from sensitive internal systems (including AI infrastructure) as defense in depth given the High/High/High impact rating.

What is the CVSS score for CVE-2026-86730?

CVE-2026-86730 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.2

What are the technical details?

Original Advisory

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().

Exploitation Scenario

An attacker first obtains low-privileged control-panel credentials for a Craft CMS instance — via phishing, credential stuffing, a leaked password, or a malicious insider — since PR:L is required. Using that access, they craft a field-layout tab element as a raw JSON string designed to bypass Craft's input-cleansing validation, embedding a Yii2 behavior attachment or event handler definition inside it. When Craft's backend processes this field-layout data and calls Craft::createObject() to instantiate the configured objects, it unknowingly instantiates the attacker-controlled class, triggering arbitrary PHP code execution on the server with the privileges of the web application process — granting the attacker a foothold for further lateral movement, data theft, or persistence.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.