Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

XLab discovered a large-scale campaign exploiting CVE-2026-26980 in Ghost CMS to steal admin API keys and inject malicious JavaScript that drives ClickFix attack flows. The activity has affected more than 700 domains, including sites linked to Harvard University, Oxford, Auburn University, and DuckDuckGo, and leveraged payloads such as UtilifySetup.exe. #GhostCMS #CVE-2026-26980 #ClickFix #UtilifySetup.exe #HarvardUniversity #OxfordUniversity #AuburnUniversity #DuckDuckGo