THREATOPS

THREAT OPS › CVEs › CVE-2025-32432

CVE-2025-32432 — Craft CMS Code Injection Vulnerability

CISA KEVExploited: confirmedCraft CMS

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

Vulnerability details

Affected productsCraft CMS
KEV remediation due2026-04-03

Related reporting

March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero-Dayrecordedfuture