Which versions of VaahCMS are affected by CVE-2026-67595?

VaahCMS versions 2.0.0 through 2.3.4 contain embedded malicious JavaScript shipped in the product itself that automatically executes in user browsers to steal login credentials and accept remote…. A patch is available.

Is there a public PoC exploit available for CVE-2026-67595?

Yes, a public proof-of-concept exploit is available for CVE-2026-67595. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-67595?

Within 24 hours, identify all systems running VaahCMS 2.0.0-2.3.4 and notify infrastructure and application teams of the supply-chain backdoor. Within 7 days, apply the vendor-released patch to upgrade all affected instances to the latest patched version and verify successful deployment. Within 30 days, complete remediation validation, confirm patch deployment across all instances, review application and web server logs for indicators of credential compromise or unauthorized access from the deployment date of the affected version forward, and require password resets for all administrative and privileged accounts.

VaahCMS CVE-2026-67595

Q: What is the CVSS score of CVE-2026-67595?

CVE-2026-67595 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50570 CRITICAL

Embedded Malicious Code (CWE-506)

2026-07-29 VulnCheck

GHSA-m2cx-9w9f-2hm7

Authentication Bypass Vaahcms

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Backdoor needs no attacker privileges (PR:N) but only fires when a victim renders the email in a JS-enabled browser (UI:R); keylogging/scraping give C:H, page overwrite gives I:H, redirect/overwrite is limited disruption (A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 29, 2026 - 22:16 vuln.today

Analysis Generated

Jul 29, 2026 - 22:16 vuln.today

CVE Published

Jul 29, 2026 - 21:33 cve.org

CRITICAL 9.2

DescriptionCVE.org

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.

AnalysisAI

Embedded malicious JavaScript (a supply-chain backdoor) in VaahCMS 2.0.0-2.3.4 executes attacker-controlled code in any browser that renders the security-OTP Blade email template with JavaScript enabled, reported by VulnCheck and rated CVSS 4.0 9.2. The obfuscated payload opens a WebSocket to a hardcoded command-and-control endpoint, keylogs password fields via a MutationObserver, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the malicious code ships in the product itself, so exposure is inherent to running an affected version.

Technical ContextAI

VaahCMS is a Laravel-based content management framework by WebReinvent, and the malicious code was planted directly in Resources/views/mails/security-otp.blade.php - the server-side Blade template that renders one-time-password security emails. Because the payload lives in a shipped template rather than being injected at exploit time, this maps to CWE-506 (Embedded Malicious Code / backdoor), a supply-chain trojan class rather than a memory-safety or input-validation defect. The script uses standard browser DOM APIs - WebSocket for C2, MutationObserver to hook dynamically inserted <input type=password> fields, postMessage for iframe/parent communication, and DOM selectors targeting WhatsApp Web (div[id=main] header) - to exfiltrate credentials and message content. The affected package is identified by CPE cpe:2.3:a:webreinvent:vaahcms:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: version 2.3.5 - upgrade VaahCMS to 2.3.5 or later, which is delivered by GitHub PR https://github.com/webreinvent/vaahcms/pull/317 and commit https://github.com/webreinvent/vaahcms/commit/8d7898f7a385a5fade1180a9b664ff158d873129 that strips the injected <script> from the security-OTP Blade template. As an immediate compensating control before upgrading, manually remove the obfuscated inline script block from Resources/views/mails/security-otp.blade.php (restoring the clean <body> tag), since it is self-contained in that single file; additionally, block or monitor outbound WebSocket connections from any host that renders the template to catch the hardcoded C2 callback, and disable JavaScript execution in any browser-based preview or rendering of OTP emails, which has the trade-off of degrading any legitimate dynamic email preview. Given the backdoor also targeted credential capture, rotate credentials and OTP secrets that may have been rendered while an affected version was live. Review the VulnCheck advisory for indicators.