CISA added a critical Craft CMS vulnerability (CVE-2025-32432) to its Known Exploited Vulnerabilities catalog after confirming active attacks in the wild. The code injection flaw allows remote attackers to execute arbitrary code on servers without authentication, potentially giving them complete control over affected systems.
Threat actors can modify websites, steal database records, or use compromised servers as launching points for deeper network attacks. Federal agencies must patch by April 3, 2026, under BOD 22-01, while CISA urges all organizations using the popular content management system to treat this as high priority and apply security updates immediately.
Source: Cybersecurity News