CVE-2025-32432: Craft CMS unauthenticated remote code execution via code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 10.0, unauthenticated network RCE, confirmed in-the-wild exploitation, and KEV listing with a near-certain EPSS score make this an emergency patch.

What it is

Craft CMS versions 3.0.0-RC1 through 3.9.14, 4.0.0-RC1 through 4.14.14, and 5.0.0-RC1 through 5.6.16 contain a code injection flaw enabling remote code execution. It is a follow-up fix to CVE-2023-41892, meaning the earlier patch was incomplete. With a CVSS score of 10.0 and no privileges or user interaction required, it is a severe exposure for any unpatched public-facing Craft install.

Impact

An unauthenticated attacker can execute arbitrary code on the server, leading to full compromise of the CMS and potentially the underlying host. This enables data theft, defacement, persistence, and lateral movement into connected systems.

Attack surface

Reachable over the network via HTTP against the Craft CMS web application, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required, so any internet-exposed instance is directly targetable.

Exploitation

CISA added it to the KEV catalog with a due date of 2026-04-03, and EPSS shows a 30-day probability of 0.99837 (99.96th percentile). A reference tagged Exploit and Press/Media Coverage describes an in-the-wild campaign, so active exploitation is confirmed.

What to do

• Upgrade Craft CMS to 3.9.15, 4.14.15, or 5.6.17 immediately; these versions contain the patch.
• If immediate upgrade is not possible, apply vendor mitigations per the Craft security advisory or take the instance offline until patched.
• Restrict network access to the Craft admin and front-end endpoints to trusted sources where feasible.
• Rotate secrets, database credentials, and API keys on any instance that may have been exposed, and review for unauthorized admin accounts or scheduled tasks.
• Monitor CISA KEV guidance and BOD 22-01 requirements for cloud-hosted instances.

Detection

• Search web and application logs for unusual POST requests or parameters targeting Craft endpoints, especially patterns associated with the prior CVE-2023-41892 exploit chain.
• Monitor for unexpected child processes spawned by the web server or PHP-FPM (for example shells, curl, or wget).
• Audit Craft CMS file system and database for newly created or modified PHP files, plugins, or scheduled tasks outside normal change windows.
• Alert on outbound network connections from the Craft host to unfamiliar IPs or domains.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.