CRITICAL

CVE-2026-26980

CVSS v3

9.4

CRITICAL

EPSS Score

54.3 %

exploit probability

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

Technical details

CVSS v3 Vector: 3.1
Published: 2026-02-20
Last Modified: 2026-02-20
Exploit-DB: EDB-52555

Frequently asked questions

What is CVE-2026-26980?

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

Is CVE-2026-26980 actively exploited?

Active exploitation of CVE-2026-26980 has not been confirmed. The EPSS score is 54.3%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-26980?

CVE-2026-26980 has a CVSS v3 base score of 9.4 (CRITICAL severity), with vector string 3.1.

Is CVE-2026-26980 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database