Mautic self-hosted · Disclosed

Three Severe Mautic Flaws; FOFA Sees 29.9K Exposed Instances

Oct 27, 2026 · 1 min read

Three vulnerabilities have been disclosed in self-hosted Mautic, a marketing automation platform: CVE-2026-115188 (CVSS 9.9), CVE-2026-115189 (CVSS 8.8) and CVE-2026-115190 (CVSS 8.0). FOFA identified more than 29.9 thousand internet-facing instances in the past year; the sources report no active exploitation and no available fix. Check whether your company runs self-hosted Mautic and monitor official advisories.

By HIFY Radar newsroom Updated 10/27/2026 04:17 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Three severe vulnerabilities have been disclosed in self-hosted Mautic, a marketing automation platform, with severity scores of 9.9, 8.8 and 8.0. FOFA identified more than 29.9 thousand internet-facing instances in the past year. The disclosure comes from a public FOFA bot alert.

Why it matters

Companies running their own Mautic may have installations reachable from the internet. Mautic automates marketing campaigns and centralizes contacts, so a compromise would hit that operation. The highest disclosed score, 9.9, indicates critical risk on the CVSS scale.

What to do

Check whether the company runs self-hosted Mautic and whether the installation is exposed to the internet. Restrict access until a fix is confirmed and monitor the vendor's official advisories. The sources give no fixed version.

For the technical team

CVE: CVE-2026-115188, CVE-2026-115189, CVE-2026-115190
Affected: Mautic self-hosted (plataforma de automação de marketing) · Mautic self-hosted (marketing automation); versions not stated in the sources.
Exploitation: No exploitation reported in the sources; CVEs at disclosure stage via the FOFA bot.
Fix: Fix unconfirmed
Vector: Component: self-hosted Mautic. Failure type and exploitation preconditions not detailed in the source. Relevant condition: more than 29.9 thousand internet-facing instances identified by FOFA in the past year.
More details: Disclosed CVEs: CVE-2026-115188 (CVSS 9.9), CVE-2026-115189 (CVSS 8.8), CVE-2026-115190 (CVSS 8.0). FOFA query: app="mautic". Single source: @fofabot post on X with a FOFA link. Incident opened 2026-10-27; no technical details, discoverer or fix provided.