Threat reportVulnerabilityTL-2026-6013
Edito CMS multiple vulnerabilities incl. JWT refresh signature bypass (CVE-2026-59074) enabling account takeover
CERT Polska disclosed eight vulnerabilities in Edito CMS on 2026-11-13. CVE-2026-59074 (CWE-347) lets an authenticated low-privileged user forge a session token for any account, including administrators, because the JWT refresh logic does not validate signatures. Other flaws include dynamic LINQ injection, three stored XSS issues, unrestricted avatar upload and untrusted JSON deserialization; fixed in 5.10.2607 with hotfixes for 5.8.
Key facts
Detection coverage
As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6013 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Edito CMS Host - IIS Worker Process Spawning Shell or LOLBin (CVE-2026-59081 Post-Exploitation)
Detects the IIS worker process (w3wp.exe) hosting the .NET Edito CMS spawning a command interpreter or living-off-the-land binary. CVE-2026-59081 (CWE-502) allows server-side code execution when untrusted JSON in cache entries is deserialized; successful exploitation, or a web shell planted via the unrestricted avatar upload (CVE-2026-59079), surfaces as a shell child of w3wp.exe.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1190, T1203
- Data sources: sysmon, index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- Severity: critical
- Confidence: high
Splunk SPL
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\whoami.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\nltest.exe") | stats count min(_time) as first_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User ParentImage Image | convert ctime(first_seen)Microsoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe", "rundll32.exe", "cscript.exe", "wscript.exe", "net.exe", "net1.exe", "nltest.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLineSigma
title: Edito CMS Host - IIS Worker Process Spawns Shell or LOLBin
id: 9d4a7c13-0e52-4b8f-a6d1-3c5f8e2b7a03
status: experimental
description: w3wp.exe spawning cmd, PowerShell or common LOLBins on an Edito CMS web server, consistent with code execution through untrusted JSON deserialization (CVE-2026-59081) or a web shell uploaded through the avatar feature (CVE-2026-59079).
references:
- https://cert.pl/en/posts/2026/11/CVE-2026-59074/
author: Threadlinqs Team
date: 2026-11-14
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1203
- cve.2026-59081
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\w3wp.exe'
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\whoami.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\cscript.exe'
- '\wscript.exe'
- '\net.exe'
- '\net1.exe'
- '\nltest.exe'
condition: selection
falsepositives:
- Legitimate administrative scripts invoked by the web application
- Deployment or health-check tooling run from the application pool
level: high
Known false positives:
- Web applications that intentionally shell out (report generators, image converters)
- Deployment or monitoring agents running under the application pool identity
Tuning notes: Baseline the child processes your Edito application pool legitimately launches and allow-list them by CommandLine. Restrict to the Edito application pool via ParentCommandLine (-ap pool name). Raise priority when the child is cmd/powershell with encoded or download-cradle arguments.
- Edito CMS Stored XSS Payload in Profile or Editor Parameters (CVE-2026-59076 / CVE-2026-59077) · unlock with TL Creds
- Edito CMS Avatar Directory - Non-Image File Written by IIS Worker (CVE-2026-59079 / CVE-2026-59078) · unlock with TL Creds
- Edito CMS Single Client Presenting Multiple Identities Including Admin Area Access (Account Takeover) · unlock with TL Creds
- Edito CMS JWT Exposed in URL Query String - Token Replay Risk (CVE-2026-59080) · unlock with TL Creds
- Edito CMS Blind sort Oracle - High Volume of Distinct sort Values from One Account (CVE-2026-59075) · unlock with TL Creds
- Edito CMS Avatar URL Served with Active-Content Extension (CVE-2026-59078 / CVE-2026-59079) · unlock with TL Creds
- Edito CMS JWT Refresh Signature Bypass - Session Forged for Another Account (CVE-2026-59074) · unlock with TL Creds
- Edito CMS Dynamic LINQ Injection in sort Parameter (CVE-2026-59075) · unlock with TL Creds
Indicators of compromise
As of 2026-11-14, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-6013.
Technical analysis
CERT Polska published an advisory on 2026-11-13 covering eight vulnerabilities (CVE-2026-59074 through CVE-2026-59081) in Edito CMS, reported to CERT Polska by the AFINE Team (Michał Majchrowicz, Dawid Małecki, Paweł Zdunek). All but one affect every version before 5.10.2607.
CVE-2026-59074 (CWE-347) is the most severe. The JWT refresh logic checks token signatures incorrectly. A logged-in, low-privileged user can submit a self-made JWT containing an existing user's identifier and receive a valid, fully signed session token for that account. This enables impersonation of any user, including administrators. NVD records a CVSS 4.0 base score of 8.7 (High) from cvd@cert.pl with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
CVE-2026-59075 (CWE-917) is a dynamic LINQ injection. An authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints and, by observing the order of returned results, extract any field's value one character at a time (a blind, boolean-style oracle), potentially exposing sensitive data.
Three stored XSS issues (CWE-79): CVE-2026-59076 via the givenName and surname parameters of /api/auth/profile, triggered when an administrator views the admin changelog logs; CVE-2026-59077 via the content parameter of the Tiny editor, triggered when a user opens the changed entry for editing; CVE-2026-59078 in the avatar upload feature, triggered when a user visits the URL of the edited avatar. The XSS in the changelog view gives a low-privileged user a path to run script in an administrator's browser.
CVE-2026-59079 (CWE-434): the UI restricts avatar uploads to certain file types, but the server accepts any file type and extension.
CVE-2026-59080 (CWE-598): Edito CMS sends JWT tokens in GET requests, so a local attacker with access to browser history could obtain a valid token and act as the victim. The token expires after a short period. The vendor rated exploitation as very unlikely and decided not to fix it, so it remains present through 5.10.2607.
CVE-2026-59081 (CWE-502): JSON is deserialized without further validation. The advisory states normal application functionality cannot trigger this, even by an administrator; an attacker able to modify or inject cache entries could execute code on the server.
The sources do not state active exploitation, a public PoC, attribution, or network IOCs. Severity HIGH is consistent with the NVD CVSS 4.0 score of 8.7 for CVE-2026-59074. The remaining CVEs have no score stated in the sources reviewed. NVD showed the CVE record as 'Deferred' at the time of review.
MITRE ATT&CK techniques by tactic:
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1606 Forge Web Credentials
Collection
T1213 Data from Information Repositories
lateral-movement
T1550.001 Use Alternate Authentication Material: Application Access Token
Remediation
Patches
- Edito CMS 5.10.2607 (fixes CVE-2026-59074 to CVE-2026-59079 and CVE-2026-59081)
- Vendor hotfixes for the 5.8 branch
Immediate actions
- Upgrade Edito CMS to 5.10.2607 or later; on the 5.8 branch apply the vendor-released hotfix
- Review authentication and session logs for refresh-endpoint requests that returned tokens for a different user than the authenticated caller
- Review admin changelog logs and profile fields (givenName, surname) for injected HTML/JavaScript
- Audit uploaded avatar files for non-image types or unexpected extensions
Workarounds
- No vendor workaround stated; CVE-2026-59080 is not fixed in 5.10.2607 (vendor decided no fix necessary)
Longer-term hardening
- Restrict low-privileged accounts and monitor for horizontal/vertical privilege changes in session issuance
- Protect the CMS cache store against unauthorized modification or injection (precondition for CVE-2026-59081)
- Deploy a Content-Security-Policy to limit impact of stored XSS in the admin UI
- Treat CVE-2026-59080 as accepted vendor risk: limit token lifetime and restrict access to browser history on shared workstations
Affected and fixed versions
- Edito — Edito CMS
Vulnerable versions: All versions before 5.10.2607 (CVE-2026-59074 to CVE-2026-59079, CVE-2026-59081); All versions through 5.10.2607 (CVE-2026-59080, not fixed by vendor decision)
Fixed in: 5.10.2607; Hotfixes released for 5.8
Timeline
- NVD record for CVE-2026-59074 last modified (15:40 UTC) with status 'Deferred'; affected range set as Edito CMS before 5.10.2607.
- Vendor assessed CVE-2026-59080 (JWT sent via GET) as very unlikely to be exploited and decided no fix was necessary; it remains present through 5.10.2607.
- NVD recorded a secondary CVSS 4.0 base score of 8.7 (High) for CVE-2026-59074 from cvd@cert.pl: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H; no exploit-maturity (E) metric was set.
- CERT Polska linked CVE.org records for all eight identifiers, CVE-2026-59074 through CVE-2026-59081, covering CWE-347, CWE-917, CWE-79 (x3), CWE-434, CWE-598 and CWE-502.
- Hotfixes for the Edito CMS 5.8 branch were released alongside 5.10.2607 for operators who cannot move to the latest release.
- Vendor fix available at publication: Edito CMS 5.10.2607 fixes CVE-2026-59074 to CVE-2026-59079 and CVE-2026-59081.
- CVE-2026-59074 published in NVD (08:17 UTC) with CVSS 4.0 base score 8.7 (High) from cvd@cert.pl and CWE-347.
- CERT Polska published the advisory 'Vulnerabilities in Edito CMS software' covering CVE-2026-59074 through CVE-2026-59081, reported by the AFINE Team (Michał Majchrowicz, Dawid Małecki, Paweł Zdunek).
Sources cited
- Vulnerabilities in Edito CMS software (CERT Polska) cert.pl · Advisory · 2026-11-13
- CVE.org record CVE-2026-59074 CVE Program · Advisory · 2026-11-13
- CVE.org record CVE-2026-59075 CVE Program · Advisory · 2026-11-13
- CVE.org record CVE-2026-59081 CVE Program · Advisory · 2026-11-13
- CERT Polska Coordinated Vulnerability Disclosure policy cert.pl · Advisory · 2026-11-13
- NVD API record for CVE-2026-59074 NVD (NIST) · Research · 2026-11-13
- Edito vendor website edito.pl · Vendor report · 2026-11-13
Previous and next in vulnerability
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —. Reviewed .
