Craft CMS Vulnerability - CISA Warns of Active Exploitation

The Flaw

A critical vulnerability has been identified in Craft CMS, specifically labeled as CVE-2025-32432. This flaw falls under the category of code injection, which is a serious security risk. It allows attackers to execute arbitrary code on the server without needing authentication. This means that anyone exploiting this vulnerability can gain full control over the affected web application, leading to potential data breaches and unauthorized access.

The vulnerability is categorized under CWE-94, which refers to improper control of code generation. Essentially, this occurs when the application fails to properly sanitize user input. Consequently, attackers can manipulate the system by injecting malicious code, which the server then executes as if it were legitimate. This type of flaw is particularly dangerous as it can lead to severe consequences for organizations using Craft CMS.

What's at Risk

Organizations relying on Craft CMS are at high risk due to this vulnerability. Once an attacker successfully exploits it, they can modify website content, steal sensitive data, or even set up a backdoor for future access. This level of control can lead to catastrophic impacts on the organization’s reputation and financial standing.

Moreover, compromised servers can be used as launch points for further attacks within the organization’s internal network. This vulnerability is not just a theoretical concern; CISA has confirmed that it is being actively exploited in the wild, making it a top priority for security teams to address immediately.

Patch Status

CISA has added CVE-2025-32432 to its Known Exploited Vulnerabilities catalog as of March 20, 2026. Federal agencies are required to remediate this vulnerability by April 3, 2026, under Binding Operational Directive 22-01. While this directive specifically targets federal entities, CISA strongly encourages all private-sector organizations to adopt the same urgent patching timeline.

Organizations must immediately apply the latest security updates provided by Craft CMS. If applying the patch is not feasible, organizations should consider temporarily discontinuing the use of the vulnerable product or following cloud service security guidance until they can implement secure mitigations.

Immediate Actions

To mitigate the risks associated with this vulnerability, organizations should take several immediate actions. First, ensure that the latest security updates from Craft CMS are applied without delay. Next, actively monitor web access logs for any signs of unauthorized access or suspicious activity.

Additionally, organizations should educate their teams about the potential risks and encourage them to report any unusual behavior. By being proactive and vigilant, organizations can significantly reduce the chances of falling victim to attacks that exploit this critical vulnerability. The time to act is now, as unpatched systems are prime targets for attackers.