Security researchers have confirmed active exploitation of CVE-2026-29014 in MetInfo CMS, enabling remote code execution on affected servers. Attackers have targeted unpatched installations worldwide since early May 2026, according to multiple threat intelligence reports released this week.
Attack Details
The vulnerability resides in MetInfo CMS, an open-source content management system used by thousands of websites. CVE-2026-29014 allows unauthenticated attackers to execute arbitrary code by sending crafted requests to vulnerable endpoints. Successful exploits grant full server access, including file uploads and command execution.
Indicators of compromise include unusual HTTP requests to /app/system/manage/data.php and deployment of web shells such as “metinfo_rce.php”. Firewall logs show traffic spikes from IP addresses in China, Russia, and the United States.
Scope and Impact
MetInfo powers websites across government, education, and corporate sectors. No official patch exists as of May 6, 2026, leaving versions 7.x and earlier exposed. Researchers estimate thousands of internet-facing instances remain vulnerable.
Exploitation follows public disclosure of the flaw last week. Attack volume has increased daily, with mass scanning detected by services like Shadowserver and GreyNoise. Compromised sites now host malware, cryptocurrency miners, and phishing pages.
- Confirmed exploits: 500+ since May 1, 2026
- Affected versions: MetInfo 7.0 through 7.3
- Attack vectors: HTTP POST to admin interfaces
Expert Responses
“Organizations must isolate and rebuild affected systems immediately,” stated a researcher from the Shadowserver Foundation. MetInfo developers acknowledged the issue on their official forum but provided no timeline for fixes.
Threat actors appear organized, reusing infrastructure from prior CMS campaigns. Links to SEO scammers alert highlight similar tactics in web compromises, where initial access leads to persistent backdoors.
Protection Measures
Administrators should apply these steps:
- Disable external access to MetInfo admin panels
- Deploy web application firewalls (WAFs)
- Monitor for anomalous file creation in web roots
- Migrate to alternative CMS platforms if patches delay
Security firms recommend full system scans using tools like Nuclei or custom YARA rules. For sites handling sensitive data, immediate air-gapping is advised until remediation completes.
Broader Context
This incident underscores ongoing risks in legacy CMS deployments. Similar flaws have hit WordPress and Drupal in recent years. Enterprises relying on reconciliation software for real estate or other sectors face amplified threats when web fronts fall.
MetInfo’s popularity in Asia amplifies global exposure. Incident response teams report data exfiltration alongside initial access, pointing to espionage motives alongside financial gain.
Next Steps
MetInfo maintainers plan a patch release soon, pending confirmation. Affected users should subscribe to vendor alerts and national CERT advisories. Cybersecurity agencies worldwide have elevated this to high-priority monitoring.
