CERT-FR Flags Multiple Moodle Vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory details XSS and security bypass flaws in Moodle versions before 4.5.15, 5.0.11, 5.1.8, and 5.2.4.
CERT-FR published an advisory on 15 October 2026 covering multiple vulnerabilities in Moodle, the widely used open-source learning management system. The flaws allow an attacker to perform remote indirect code injection (cross-site scripting) and bypass security policy controls. Affected versions include Moodle 5.0.x before 5.0.11, 5.1.x before 5.1.8, 5.2.x before 5.2.4, and all versions before 4.5.15.
Three CVEs are referenced (CVE-2026-47759, CVE-2026-47761, CVE-2026-47762) corresponding to Moodle's own security bulletins (forum posts 482830 and 482831). No exploitation in the wild is mentioned. CERT-FR recommends applying the vendor's official patches referenced in the Moodle security bulletins. Given the education sector's heavy reliance on Moodle, administrators should prioritize patching to prevent potential XSS-based session hijacking or unauthorized actions via bypassed security controls.
Mentioned in this report
Detection guidance
Script Injection Payload in Request to Moodle LMS Paths
Detects XSS-style script payloads (script tags, event handlers, javascript: URIs) in query strings sent to typical Moodle endpoints, which may indicate attempts to exploit Moodle XSS flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script Injection Payload in Request to Moodle LMS Paths
description: 'Detects XSS-style payloads (script tags, inline event handlers, javascript:
URIs, raw or URL-encoded) in the query string of requests to common Moodle endpoints.
Intended as a hunting and detection aid for the Moodle XSS vulnerabilities in the
CERT-FR advisory (CVE-2026-47759, CVE-2026-47761, CVE-2026-47762). The advisory
does not describe specific vectors, so this is a generic pattern. Reflected payloads
only; stored XSS submitted via POST body will not be visible.'
tags:
- attack.execution
- attack.t1059.007
logsource:
category: webserver
detection:
selection_moodle:
cs-uri-stem|contains:
- /moodle/
- /mod/
- /course/
- /user/
- /lib/ajax/
- /message/
- /calendar/
- /login/
selection_xss:
cs-uri-query|contains:
- <script
- '%3Cscript'
- onerror=
- onload=
- onmouseover=
- 'javascript:'
- '%3Csvg'
- <svg
condition: selection_moodle and selection_xss
falsepositives:
- Authorized web vulnerability scanners run against the Moodle site
- Course content editors or plugins that legitimately pass HTML fragments in GET parameters
level: medium
id: 248b8019-59b6-5855-8558-86d9c57a3a41
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1318
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1318
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs