Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-9558.
Upgrade to ProDetect Mautic Server-Side Template Injection (SSTI) in Theme Templates in Microsoft Sentinel
Detects exploitation of CVE-2026-9558, a critical (CVSS 9.9) Server-Side Template Injection vulnerability in Mautic's theme template engine (CWE-1336, Twig-based SSTI). An authenticated or in some deployments unauthenticated attacker can inject malicious Twig template syntax through theme customization, email/landing page builder, or theme upload/import functionality, achieving remote code execution on the underlying PHP host. Affects mautic/core versions >=1.3.0 <4.4.13, >=5.0.0 <5.2.11, >=6.0.0 <6.0.9, and >=7.0.0 <7.1.2. A public PoC/advisory exists (GHSA-9fx4-7cmj-47vg).
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
let ThemeTwigMarkers = dynamic(['{{', '}}', '{%', '%}', '_self', 'getFilter', '__construct', 'system(', 'exec(', 'passthru(', 'proc_open(', 'shell_exec(']);
AppServiceHTTPLogs
| where ScmType == "" or CsHost has "mautic"
| where CsUriStem has_any ("/s/themes", "/s/emails", "/s/pages", "/s/dynamicContent", "/theme/upload", "/api/themes")
| where CsMethod in ("POST", "PUT")
| extend DecodedBody = url_decode(tostring(CsUriQuery))
| where DecodedBody has_any (ThemeTwigMarkers) or CsUriQuery has_any (ThemeTwigMarkers)
| project TimeGenerated, CIp, CsMethod, CsUriStem, CsUriQuery, ScStatus, CsUserAgent
| order by TimeGenerated descDetects HTTP requests to Mautic theme/email/page builder endpoints containing Twig template injection payload markers (delimiters, __construct, or PHP function-call patterns commonly used in Twig SSTI-to-RCE chains) consistent with exploitation of CVE-2026-9558.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate developers testing Twig syntax in theme customization during authorized development work
- Automated vulnerability scanners probing the endpoint without actual exploitation intent
- WAF/proxy logging that URL-encodes curly braces from unrelated JSON payloads
Other platforms for CVE-2026-9558
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Twig SSTI probe against theme endpoint
Expected signal: Web access log entry for POST /s/themes/edit/1 containing the literal string {{7*7}}; if vulnerable, the rendered theme output contains '49'.
- Test 2Twig-to-PHP function call injection
Expected signal: Web log entry showing POST to /s/emails/edit/1 with __construct/getFilter/system( markers; process telemetry showing php-fpm spawning 'id' if the gadget chain succeeds in the lab sandbox.
- Test 3Post-exploitation shell spawn simulation from PHP-FPM
Expected signal: Process creation events showing bash/id/whoami/curl spawned with parent process php-fpm running as www-data, plus an outbound connection to the test callback listener.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-9558 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month