Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-9559.
Upgrade to ProDetect Mautic Campaign Import Path Traversal (CVE-2026-9559) in Microsoft Sentinel
Detects exploitation attempts against CVE-2026-9559, a critical path traversal vulnerability (CVSS 9.9) in Mautic core's Campaign Import feature affecting versions >=7.0.0, <7.1.2. An unauthenticated or low-privileged attacker can craft a malicious campaign import file (CSV/ZIP) containing path traversal sequences (../) or archive entries that write files outside the intended import directory, potentially achieving arbitrary file write and remote code execution via webshell placement. A public PoC exists (GHSA-6r9h-4h75-7q4x). This detection identifies suspicious campaign import requests, path traversal payloads in multipart uploads, unexpected file writes outside Mautic's media/import directories, and subsequent webshell execution.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
let SuspiciousPaths = dynamic(["..%2f","..%5c","../../","..\\..\\","%2e%2e%2f","%252e%252e%252f"]);
let ImportEndpoints = dynamic(["/s/campaigns/import","/s/campaigns/batch","campaign.import","/api/campaigns/import"]);
W3CIISLog
| where cs_uri_stem has_any (ImportEndpoints)
| where cs_uri_query has_any (SuspiciousPaths) or cs_method == "POST"
| extend DecodedQuery = url_decode(cs_uri_query)
| where DecodedQuery has_any (SuspiciousPaths)
| project TimeGenerated, c_ip, cs_method, cs_uri_stem, DecodedQuery, sc_status, cs_User_Agent
| union (
AzureDiagnostics
| where Category == "ApplicationGatewayAccessLog"
| where requestUri_s has_any (ImportEndpoints)
| where httpMethod_s == "POST"
| extend DecodedUri = url_decode(requestUri_s)
| where DecodedUri has_any (SuspiciousPaths)
| project TimeGenerated, c_ip = clientIP_s, cs_method = httpMethod_s, cs_uri_stem = requestUri_s, DecodedQuery = DecodedUri, sc_status = httpStatus_d, cs_User_Agent = userAgent_s
)
| sort by TimeGenerated descDetects POST requests to Mautic campaign import endpoints containing URL-encoded or literal path traversal sequences, indicative of CVE-2026-9559 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate file paths containing double dots in filenames (rare but possible in test data)
- Security scanners/pentest tools probing the endpoint intentionally as part of authorized assessments
- Misconfigured proxies double-encoding legitimate query strings
Other platforms for CVE-2026-9559
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Path Traversal Campaign Import POST (Linux)
Expected signal: HTTP POST log entry to /s/campaigns/import with URL/multipart filename containing '../' sequences; potential file creation event for shell.php outside the intended import directory.
- Test 2Verify Unauthorized File Write Outside Import Directory (Linux)
Expected signal: File creation/modification event logged by EDR/FIM for a PHP file outside the intended import directory.
- Test 3Simulate Campaign Import Traversal via ZIP Archive (Windows)
Expected signal: IIS W3C log entry for POST to /s/campaigns/import with an unusual multipart body size; potential unauthorized file write event under C:\inetpub\wwwroot outside media\files\import.
- Test 4Validate Mautic Version Vulnerability Check (macOS)
Expected signal: No network telemetry generated; local file read only.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-9559 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month