Vulnerability intelligence
CVE-2025-32432
Craft CMS Code Injection Vulnerability
Craft CMS Craft CMS
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
CVSS Score
—
Unrated
EPSS — Exploit Probability
100%
Riskier than 100% of all CVEs · checked 2026-09-04
Exploitation
Confirmed in the wild
KEV since 2026-03-20
Remediation
Unconfirmed
Federal deadline 2026-04-03
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-04-03.
5 articles across 4 outlets · first covered Mar 20, 2026 · latest Mar 22, 2026
Coverage timeline
-
U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Mar 22, 2026
-
CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026thehackernews.com · Mar 21, 2026
-
CISA Adds Five Known Exploited Vulnerabilities to Catalogwww.cisa.gov · Mar 20, 2026
-
CISA Adds CVE-2025-32432 to Known Exploited Vulnerabilities Cataloguewww.cisa.gov · Mar 20, 2026
-
CISA Adds CVE-2025-32432 to Known Exploited Vulnerabilities Cataloguecisa.gov · Mar 20, 2026