CVE-2025-32432: Craft CMS Pre-Auth Remote Code Execution (KEV)

CVE-2025-32432 is a remote code execution vulnerability in Craft CMS that a remote, unauthenticated attacker can exploit with no privileges or user interaction, and it was being actively used in a real-world exploitation campaign before the vendor's fix was public, prompting CISA to add it to the KEV catalog within days of patch release.

CVE-2025-32432 is a remote code execution flaw (CWE-94, code injection) in Craft CMS, a PHP-based content-management system used for custom digital-experience websites. The vendor's GitHub advisory describes it as "a high-impact, low-complexity attack" and states the issue is an additional fix layered on top of a previously disclosed, related vulnerability (GHSA-4w8r-3xrw-v25g) — i.e. the earlier patch was incomplete and this CVE closes the remaining gap (Craft CMS GHSA-f3gw-9ww9-jmc3).

NVD assigns a Primary CVSS v3.1 score of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction, full confidentiality/integrity/availability impact, with a scope change reflecting that compromising Craft CMS can affect resources beyond the vulnerable component itself (NVD). GitHub's own Secondary submission agrees at 10.0 but rates availability impact as low (A:L) rather than high, a minor difference from NVD's worst-case assessment.

The flaw affects Craft CMS 3.0.0-RC1 through 3.9.14 (fixed in 3.9.15), 4.0.0-RC1 through 4.14.14 (fixed in 4.14.15), and 5.0.0-RC1 through 5.6.16 (fixed in 5.6.17), all shipped 2025-04-10 (Craft CMS GHSA-f3gw-9ww9-jmc3).

Security researchers at Orange Cyberdefense/SensePost documented an in-the-wild campaign abusing this RCE, chaining it with a separate Yii framework deserialization bug to gain code execution on compromised Craft CMS sites — this real-world exploitation activity is what drove CISA's rapid KEV addition rather than a purely theoretical finding (SensePost: investigating an in-the-wild campaign using RCE in CraftCMS).

CISA added CVE-2025-32432 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-03-20, with a required-action due date of 2026-04-03; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.99792 (99.956th percentile) — among the highest EPSS scores possible, consistent with a confirmed, actively-exploited, unauthenticated RCE in widely deployed web CMS software (FIRST EPSS).

Any Craft CMS install on an affected build should be upgraded to the patched version immediately and audited for unauthorized admin users, file uploads or scheduled tasks created since the last known-good state, given the confirmed in-the-wild campaign.

• Craft CMS contains a remote code execution flaw exploitable by an unauthenticated attacker with low complexity; it is an additional fix for a previously disclosed, related vulnerability. — Craft CMS GHSA-f3gw-9ww9-jmc3
• NVD Primary CVSS v3.1 is 10.0 (critical), vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
• Affected: Craft CMS 3.0.0-RC1-3.9.14, 4.0.0-RC1-4.14.14, 5.0.0-RC1-5.6.16; all fixed in builds shipped 2025-04-10 (3.9.15 / 4.14.15 / 5.6.17). — Craft CMS GHSA-f3gw-9ww9-jmc3
• Researchers documented an in-the-wild exploitation campaign chaining this RCE with a Yii framework deserialization bug against live Craft CMS sites. — SensePost
• Added to the CISA KEV catalog on 2026-03-20, due date 2026-04-03; known ransomware-campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.99792 (99.956th percentile) as of 2026-10-29. — FIRST EPSS