Which versions of Craft CMS are affected by CVE-2026-79987?

Craft CMS contains a privilege escalation vulnerability allowing authenticated Control Panel users with basic permissions to execute arbitrary operating system commands with web server privileges.. A patch is available.

How to fix or mitigate CVE-2026-79987?

Within 24 hours, inventory all Craft CMS installations and audit which non-administrative users hold active Control Panel access; implement temporary access restrictions for non-administrative users if operationally feasible. Within 7 days, deploy vendor-released patch version 5.10.13 to all Craft CMS instances and revalidate Control Panel user permission assignments against current business needs. Within 30 days, establish a principle-of-least-privilege access policy ensuring Control Panel permissions are restricted to administrative users only, with non-administrative staff using delegated content-management tools or APIs instead of direct Control Panel access.

Craft CMS CVE-2026-79987

Q: What is the CVSS score of CVE-2026-79987?

CVE-2026-79987 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-75586 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-09-10 Hackrate

GHSA-fpmm-w3hp-7f39

PHP Cms Craftcms

8.7

CVSS 4.0 · Vendor: Hackrate

Severity by source

Vendor (Hackrate) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible CP, no special attack conditions, low-privilege CP account required (PR:L), full RCE gives C/I/A:H; no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Hackrate).

CVSS VectorVendor: Hackrate

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 10, 2026 - 19:25 vuln.today

Patch available

Sep 10, 2026 - 18:02 EUVD

Metadata Corrected

Sep 10, 2026 - 17:40 vuln.today

tag: Information Disclosure removed

Source Code Evidence Fetched

Sep 10, 2026 - 16:41 vuln.today

Analysis Generated

Sep 10, 2026 - 16:41 vuln.today

CVE Published

Sep 10, 2026 - 16:05 cve.org

HIGH 8.7

DescriptionCVE.org

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

AnalysisAI

Remote code execution in Craft CMS allows any authenticated Control Panel user holding only the minimum accessCp permission to execute arbitrary operating system commands as the PHP web worker process. The flaw (GHSA-9c4j-cjw3-r3xx, CWE-470) bypasses the assumption that non-administrative CP users are restricted to content management operations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) a valid Craft CMS Control Panel account with at minimum the `accessCp` permission - no admin role needed; (2) network reachability to the CP endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the severity when CP access is achievable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Craft CMS to version 5.10.13 or later immediately; this is the vendor-confirmed fix per GitHub release notes and security advisory GHSA-9c4j-cjw3-r3xx (https://github.com/craftcms/cms/security/advisories/GHSA-9c4j-cjw3-r3xx). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Craft CMS installations and audit which non-administrative users hold active Control Panel access; implement temporary access restrictions for non-administrative users if operationally feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PHP

View all

CVE-2019-11043 CRITICAL Emergency POC

9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL Act Now POC

9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL Act Now POC

9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2018-11138 CRITICAL Emergency POC

9.8 May 31

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by

CVE-2024-11680 CRITICAL Act Now POC

9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL Act Now POC

9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL Act Now POC

9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH Act Now POC

8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL Emergency POC

10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

Same weakness CWE-470 – Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

View all

CVE-2026-82078 CRITICAL POC

9.4

CVE-2024-0200 CRITICAL POC

9.8

CVE-2024-4990 CRITICAL POC

9.1

CVE-2024-28121 HIGH POC

8.8

CVE-2023-33652 HIGH POC

8.8

CVE-2026-58659 HIGH POC

8.4

CVE-2022-30287 HIGH POC

8.0

CVE-2025-68455 HIGH POC

7.2

CVE-2026-79987 vulnerability details – vuln.today

Back

Craft CMS CVE-2026-79987

Severity by source

CVSS VectorVendor: Hackrate

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in PHP

Same weakness CWE-470 – Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Share

External POC / Exploit Code