CVE-2020-26167
Source CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 10:12 UTC
Rated Critical by the CNA (mitre) · No CVSS score from NVD or the CNA
- EPSS
- 3.4% chance of exploitation in 30 days – higher than 88% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 4 Nov 2020
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | Affected
| Fixed in– |
AI-suggested
In the absence of an official patch, organizations should disable or restrict access to the page preview feature, especially for anonymous users. Implementing web application firewalls (WAFs) with rules to detect and block suspicious requests targeting the preview functionality can provide temporary protection. Conduct thorough access control reviews and ensure that session management and user impersonation mechanisms are secure. Regularly audit CMS user accounts for unauthorized changes and monitor logs for unusual activity. Additionally, organizations should isolate the CMS environment from critical internal networks to limit lateral movement in case of compromise. Finally, organizations should prepare incident response plans specifically addressing CMS compromises.
Description
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.