CISA Issues Urgent Warning as Hackers Exploit Critical Craft CMS Vulnerability

CISA warns of a critical Craft CMS flaw (CVE-2025-32432) allowing remote code execution. Agencies must patch by April 3, 2026.

By Content Team

Mar 24, 2026

ON THIS PAGE

CISA added a critical Craft CMS vulnerability (CVE-2025-32432) to its Known Exploited Vulnerabilities catalog after confirming active attacks in the wild. The code injection flaw allows remote attackers to execute arbitrary code on servers without authentication, potentially giving them complete control over affected systems.

Threat actors can modify websites, steal database records, or use compromised servers as launching points for deeper network attacks. Federal agencies must patch by April 3, 2026, under BOD 22-01, while CISA urges all organizations using the popular content management system to treat this as high priority and apply security updates immediately.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?