CMS Exploitation Campaign Nuclei Templates

Defensive Nuclei template pack for the large-scale CMS exploitation campaign reported by ASD's Australian Cyber Security Centre on 9 July 2026.

Advisory: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms

Context

This alert is relevant to all Australian website owners and website managers, and is intended for a technical audience.

ASD's ACSC reported a large-scale exploitation campaign targeting vulnerabilities in content management systems globally, including in Australia, with many small to medium sized Australian businesses impacted.

Malicious cyber actors are actively scanning websites for opportunities to deploy webshells by leveraging vulnerabilities in CMS software and plugins. The exploited vulnerability classes primarily allow unauthenticated file upload, remote code execution, server side request forgery or deserialisation.

Once deployed, webshells can allow remote access and control of targeted web servers. Compromised servers may be used for website defacement or disruption, credential and data capture, malware delivery to legitimate website users, or as a pathway for broader network compromise.

Coverage

This repository includes 16 CVE templates and 2 product-only detection templates for the campaign set.

pay-uz-detect.yaml and maxsite-cms-detect.yaml confirm product presence only. They do not confirm vulnerable version or exploitability.

Where available, passive Wordfence-derived checks from topscoder/nuclei-wordfence-cve were preferred over active POST checks. Remaining POST-based templates are limited to cases where no passive replacement has been added here.

Clone and run

Install or update Nuclei:

go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
nuclei -update

Clone this repository:

git clone https://github.com/rxerium/cms-exploitation-campaign.git
cd cms-exploitation-campaign

Create a target list with one URL per line:

cat > targets.txt <<'EOF'
https://example.com
https://cms.example.org
EOF

Run all templates:

nuclei -l targets.txt -t . -o cms-campaign-results.txt

Run with conservative rate limits:

nuclei -l targets.txt -t . -rl 5 -c 2 -retries 1 -timeout 10 -o cms-campaign-results.txt

Run a single CVE template:

nuclei -l targets.txt -t CVE-2024-9234.yaml -o CVE-2024-9234-results.txt

Run a product-only detection template:

nuclei -l targets.txt -t pay-uz-detect.yaml -o pay-uz-detect-results.txt

Immediate mitigation guidance

ASD's ACSC recommends website owners confirm whether servers have been impacted and remediate accordingly:

• Inspect CMS web directories and plugin directories for webshells or abnormal internet-facing file changes.
• Examine web access logs for IP addresses making GET or POST requests to webshell paths.
• Treat servers with identified webshells as compromised, isolate them, and audit authentication and network logging.
• Look back for suspicious web requests linked to initial exploitation and webshell deployment.
• Review network logs for interactions with IP addresses seen communicating with webshells.
• Investigate logging and hosts for persistence, lateral movement, account creation, exfiltration attempts or malware deployment.
• Patch vulnerable systems to prevent reinfection, remove or quarantine webshells and malware, remove persistence mechanisms, and only bring systems back online when safe.
• Restore websites from a recent known-good backup where compromise is indicated.

Additional protections include keeping CMS software and plugins up to date, applying security patches automatically where acceptable, disabling plugins with actively exploited vulnerabilities until patched, using cloud services where providers rapidly remediate vulnerabilities, monitoring or blocking web directory file creation, restricting file and path access, monitoring unexpected webserver child processes, applying application control, and limiting unnecessary network communication between internet-facing websites and corporate devices.

If a service provider maintains your website, point them to the advisory. Organisations that have been impacted, suspect impact or require advice and assistance can notify ASD's ACSC via https://www.cyber.gov.au/report.

Credits

Templates were collected from or derived from:

• ProjectDiscovery nuclei-templates: https://github.com/projectdiscovery/nuclei-templates
• topscoder nuclei-wordfence-cve: https://github.com/topscoder/nuclei-wordfence-cve
• Wordfence Intelligence: https://www.wordfence.com/threat-intel/
• rxerium templates: https://github.com/rxerium/rxerium-templates
• ASD's ACSC advisory above

Use only on assets you own or are authorised to assess. Validate findings manually before treating a host as vulnerable.