CISA Warns of Craft CMS Code Injection Flaw Exploited in Active Attacks

CISA added CVE-2025-32432 (CVSS v3.1 10.0) to its Known Exploited Vulnerabilities catalog after active in-the-wild exploitation was observed. The flaw is an insecure deserialization/code injection in Craft CMS (affecting 3.x, 4.x, and 5.x branches) that allows unauthenticated remote code execution via a poisoned session file and a Yii framework gadget chain; vendors released patches (3.9.15, 4.14.15, 5.6.17) and organizations are urged to patch immediately, monitor for webshells/reverse shells, and comply with CISA remediation deadlines.