CVE-2026-8054
CWE-89Published: May 27, 2026· Updated: May 27, 2026
Official Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
Risk Analysis
A critical SQL Injection vulnerability in dotCMS Core's Publish Audit API endpoints allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. This is due to a lack of authentication enforcement and unsanitized input. With a CVSS score of 10.0, this represents an extremely severe risk, and its presence in CISA's KEV catalog confirms active exploitation.
This vulnerability is actively being exploited in the wild. It is remotely exploitable by unauthenticated attackers.
Upgrade dotCMS Core to version 26.04.28-03 or later. Ensure all API endpoints enforce proper authentication and validate all user-supplied input.
Technical Analysis
CVE-2026-8054 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
CISA has added CVE-2026-8054 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-89)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-8054 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1