CVE-2025-32432: Craft CMS unauthenticated remote code execution, exploited in the wild
The short version: Craft CMS has an unauthenticated remote code execution flaw (CVE-2025-32432) that scores a perfect 10.0. It's low-complexity, it was exploited in the wild as part of a real campaign, and it's in CISA's KEV catalog. If you run Craft, this is patch-and-verify, not patch-and-forget. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, exploited in the wild |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVSS (CNA) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
| EPSS | ~99.8% · 99.96th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-04-03 |
| Known exploited? | Yes — exploited in the wild; documented campaign chaining it for RCE |
| Vulnerability type | CWE-94 code injection → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Craft CMS 3.0.0-RC1 → before 3.9.15, 4.0.0-RC1 → before 4.14.15, and 5.0.0-RC1 → before 5.6.17 |
| Fixed in | Craft CMS 3.9.15 · 4.14.15 · 5.6.17 (or later) |
What you need to know
Craft CMS is a widely used PHP content-management system, and it's a public web application by nature. CVE-2025-32432 is an unauthenticated remote code execution flaw described by the vendor as a high-impact, low-complexity attack vector — meaning an attacker needs no credentials and little effort to run code on an affected server.
Why it ranks at the top:
- It's a perfect 10.0, unauthenticated, and scope-changing. No login, no user interaction, and the impact reaches beyond the vulnerable component.
- It was live in the wild. Security researchers documented an in-the-wild campaign using this flaw for remote code execution — the theoretical was operational.
- It's directly internet-facing. A Craft site is meant to be reachable, so an affected install is exposed by design.
How serious we see it
High — the 10.0 is not hyperbole. Unauthenticated, low-complexity code execution on a public web application, confirmed exploited in the wild and KEV-listed, is exactly the profile you patch first. The bounded, reassuring part is that it's fixable and quick to scope: the affected ranges are clearly defined across the 3.x, 4.x, and 5.x lines, and fixed releases are published. The catch is the usual one for an in-the-wild flaw — patched and clean are different questions, so hunt as well as upgrade.
Recommendations
Straight from Craft's advisory (GHSA-f3gw-9ww9-jmc3) and CISA:
- Upgrade now. Move to Craft CMS 3.9.15 / 4.14.15 / 5.6.17 or later.
- Restrict access until patched. If you can't upgrade immediately, limit reachability to the affected site.
- Hunt. Review web and application logs for exploitation attempts, unexpected file writes, and anomalous process activity.
- If compromised, respond fully. Rebuild from a known-good state and rotate application secrets, database credentials, and keys.
- Confirm your exposure first. Verify whether you run Craft and which version.
How BreachRisk sees it
BreachRisk works from the outside in. Starting from little more than your domain, it discovers your internet-facing web applications, fingerprints Craft CMS and its version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, attacker's-eye view means a Craft site is already on your map — including the one a marketing or product team spun up on their own — so when a 10.0 RCE breaks you go straight to patch-and-verify.