Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
#ExploitGrid Daily #Digest 🚨 Top Exploits: CVE-2026-90970 (CVSS: 9.9) GitLab CVE-2026-9558 (CVSS: 9.9) CVE-2026-15989 (CVSS: 9.8) WebRehab CVE-2026-15989 (CVSS: 9.8) WebRehab CVE-2026-19660, CVE-2026-14378 (CVSS: 9.8) DiviEngine ..🧵👇
[EXPLOIT] CVE-2026-9558 [CRITICAL/PoC] CVSS: 9.9 CVE-2026-9558-lab-poc-bundle 🔗 https://exploitgrid.net/exploits/42c95fc8-99d9-4276-8f0d-0751bec7747f
💀 CRITICAL Exploits Trending ├ CVE-2026-90970 — GitLab AI Gateway · PoC live (9.9) ├ CVE-2026-9558 · PoC live (9.9) ├ CVE-2026-15989 — WebRehab · 2 separate PoCs live (9.8) └ CVE-2026-19660 + CVE-2026-14378 — DiviEngine · PoC live (9.8)
CVE-2026-9558 Server-Side Template Injection Remote Code Execution in Mautic Theme Engine https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9558
Post summary
The post announces CVE-2026-9558, a server‑side template injection that enables remote code execution in Mautic’s theme engine, without providing PoC, exploit, or patch information.