CISA Warns of Craft CMS Code Injection Vulnerability Exploited in Attacks
A critical vulnerability in Craft CMS (CVE-2025-32432) has been added to the Known Exploited Vulnerabilities catalog following confirmed active exploitation.
A critical vulnerability in Craft CMS (CVE-2025-32432) has been added to the Known Exploited Vulnerabilities catalog following confirmed active exploitation.
Security teams and system administrators are advised to address this issue immediately to prevent severe network compromises.
The vulnerability is a severe code injection flaw, categorized under CWE-94, involving improper control of code generation.
This weakness occurs when a software application fails to properly sanitize or validate user-supplied input before interpreting it as executable instructions.
Craft CMS, a popular content management system, is significantly at risk due to this vulnerability.
It allows a remote, unauthenticated attacker to execute arbitrary code directly on the underlying server.
Once an attacker achieves remote code execution, they can take complete control over the affected application, modify website content, exfiltrate sensitive database records, or establish a persistent backdoor.
Security teams and system administrators are advised to address this issue immediately to prevent severe network compromises.
A compromised web server can serve as a strategic launching point for lateral pivoting into an organization’s internal network.
By adding CVE-2025-32432 to the KEV catalog on March 20, 2026, CISA has confirmed that this flaw is being leveraged in real-world attacks.
Code injection and remote code execution vulnerabilities are highly sought-after by threat actors, including state-sponsored groups and initial access brokers. Organizations using Craft CMS must treat this as a high-priority threat.
Unpatched content management systems exposed to the internet are highly visible targets and likely being actively scanned and exploited by automated attack tools.
Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch agencies are mandated to remediate this vulnerability to protect federal networks.
CISA has set a compliance deadline of April 3, 2026, for federal agencies to apply the necessary mitigations.
While this directive applies to government entities, CISA strongly urges all private-sector organizations and global enterprises to adopt the same aggressive patching timeline.
System administrators must apply the latest security updates provided in the vendor instructions immediately.
Organizations should monitor their web access logs for any anomalous behavior or unauthorized administrative access attempts.
If applying the official patch is not feasible, organizations must follow applicable cloud service security guidance or temporarily discontinue use of the vulnerable product until secure mitigations are in place.
Based on reporting by Cyber Security News.