Security readout for executives and security teams
Plain-English summary
VaahCMS 2.0.0 through 2.3.4 reportedly shipped malicious JavaScript inside its security OTP email template. If a browser executes that script while rendering the content, it can capture passwords, collect WhatsApp Web content, contact a command-and-control server, and alter or redirect the page.
Executive priority
Treat this as an immediate incident-response and remediation priority. Confirm exposure, patch affected installations, investigate possible browser execution, and evaluate credential compromise. Give additional urgency to environments where affected OTP content was rendered with JavaScript enabled.
Technical view
The reported supply-chain compromise is an obfuscated payload in security-otp.blade.php. It opens a WebSocket to a hardcoded command-and-control endpoint, monitors dynamically created password fields, scrapes WhatsApp Web DOM content, and accepts page-redirection or overwrite commands. Execution is conditional on the rendering environment allowing JavaScript.
Likely exposure
Prioritize VaahCMS deployments running versions 2.0.0 through 2.3.4, particularly systems that generated security OTP emails. Practical exposure depends on whether recipients rendered affected content in a browser context that permits embedded JavaScript. The supplied structured affected-version entry is inconsistent with the narrative range, so verify against vendor records.
Exploitation context
The bundle provides no evidence of active exploitation, and its KEV field is false. That does not prove exploitation is absent. The embedded command-and-control, credential-capture, content-scraping, and remote page-control capabilities indicate substantial impact if the payload executes.
Researcher notes
CWE-506 appropriately describes embedded malicious code. The CVSS 4.0 score is 9.2, but its UI:N metric appears difficult to reconcile with the stated requirement that affected content be rendered with JavaScript enabled. The structured affected entry also names a patch commit alongside version 2.0.0; authoritative fixed-version boundaries remain unclear.
Mitigation direction
- Identify and isolate VaahCMS installations running versions 2.0.0 through 2.3.4.
- Apply the vendor patch represented by commit 8d7898f7a385a5fade1180a9b664ff158d873129 after testing.
- Check vendor guidance for a confirmed fixed release before returning affected systems to normal operation.
- Consider credential resets for users whose browsers may have executed affected OTP content.
- Block confirmed command-and-control indicators identified in the advisory or patch investigation.
Validation and detection
- Inventory deployed VaahCMS versions and determine whether affected OTP emails were generated.
- Compare security-otp.blade.php against the vendor patch and investigate unexpected obfuscated JavaScript.
- Review browser, proxy, DNS, and WebSocket telemetry for advisory-confirmed command-and-control indicators.
- Assess whether affected email-rendering environments permitted embedded JavaScript execution.
- Preserve relevant templates, generated messages, and network logs for incident investigation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-506: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-67595 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Pull RequestCVE reference, VulnCheck · issue-tracking
- Patch CommitCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/vaahcms-malicious-javascript-supply-chain-via-security-otp-blade-phpCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Embedded Malicious Code
Embedded Malicious Code represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.