Craft CMS flaw CVE-2026-123488 reported exploited; fixed versions 4.18.9 and 5.11.2 listed
A flaw in the Craft CMS website platform is now reported as used in real attacks. Sites running older versions of the software should be checked and updated.
Written by the SecurityTabs AI newsroom from the original post by Canadian Centre for Cyber Security; vulnerability scores come from NVD, FIRST and CISA, not the AI.
An advisory for Craft CMS, first issued on October 26 and updated on November 12, says open source reporting indicates that CVE-2026-123488 is being exploited in the wild. The update is the change from the original notice. [1]
The advisory lists the affected versions as Craft CMS releases prior to 4.18.9 and prior to 5.11.2, and the Commerce-mollie plugin prior to 4.4.3. It describes the status as of October 23. [1]
No severity score or CISA Known Exploited Vulnerabilities listing is available for the CVE yet, and the advisory excerpt does not describe the type of flaw or how attacks work. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]Canadian Centre for Cyber Security
Craft CMS security advisory (AV26-1086) - Update 1