AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)

CVE-2025-32432: Craft CMS Code Injection Vulnerability

infovulnerability🔥 Actively Exploited

security

Source: CISA Known Exploited VulnerabilitiesMarch 19, 2026CVE-2025-32432

Summary

Craft CMS contains a code injection vulnerability (a flaw that lets attackers insert and run malicious code) that allows remote attackers to execute arbitrary code (run commands they shouldn't be able to run). This vulnerability is actively being exploited by attackers in the real world.

Solution / Mitigation

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability Details

EPSS (30-day exploit probability)

EPSS: 79.0%

Patch Available

Yes

Exploit Maturity

🔥 Actively Exploited

Disclosure Date

March 19, 2026

Classification

Attack SophisticationModerate

Taxonomy References

CWE (Weakness Type)

CWE-94

CAPEC (Attack Pattern)

CAPEC-242

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-32432

First tracked: March 20, 2026 at 02:00 PM

Classified by LLM (prompt v3) · confidence: 95%