Is CVE-2025-35939 (Craft CMS External Control of Assumed-Immutable Web Parameter) being exploited in the wild?

Yes. CISA added CVE-2025-35939 to its Known Exploited Vulnerabilities catalogue on 2 June 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Craft CMS contains an external control of assumed-immutable web parameter vulnerability. Any organisation running the affected product should treat remediation as urgent.

What it means for a CVE to be actively exploited

CISA’s KEV listing is the practical signal that moves a vulnerability from “watch” to “act now.” For this case, the important question is not whether the flaw is interesting in theory, but whether your environment runs the vulnerable Craft CMS product and whether internet-facing or externally reachable instances exist.

An exploited-in-the-wild finding means defenders should assume opportunistic scanning and follow-on intrusion attempts are already happening. That changes prioritisation: inventory first, then exposure assessment, then remediation scheduling, with the CISA Known Exploited Vulnerabilities Catalog used as the authoritative reference point for urgency.

How to confirm whether you are exposed

Start by confirming whether any deployed instance is actually Craft CMS and whether it matches the vulnerable condition described in the product advisory. In practice, that means identifying all internet-facing web properties, application hosts, containers, and managed platforms that might run the CMS, then tracing them back to owners and patch state.

For validation work, use the NIST National Vulnerability Database and the vendor advisory together, because version and remediation specifics belong there, not in a secondary summary. If you maintain vulnerability management workflows, the Vulnerability Management Guide is a useful operational companion for scoping, prioritisation, and exception handling.

The web-application angle matters because this vulnerability class sits in application input handling and request trust boundaries, not in an infrastructure-only control. The broader Web Application Attacks Guide helps frame why parameter manipulation issues are often exploited quickly once they are publicly known.

Why remediation should be treated as urgent

Once a vulnerability is in KEV, the defender’s working assumption should be that attackers already know how to find it. That does not mean every exposed instance is compromised, but it does mean delay increases the chance of exploitation, especially where the system is reachable from the public internet or sits behind a weak change-control process.

The operational response is to patch or otherwise mitigate first, then verify whether the system was touched before the fix. If immediate remediation is blocked, isolate or restrict access to the affected instance, reduce exposure paths, and document the exception with a short, dated risk acceptance rather than an open-ended deferment.

CVE Program records and the vendor advisory should remain the source of truth for the exact product details and fix guidance, while CISA KEV tells you why the issue has crossed into active exploitation territory.

Risk and Threat Considerations

Active exploitation changes the risk profile from theoretical exposure to likely attack traffic. For a web CMS, the most material concern is that adversaries can move quickly from initial probing to privilege abuse, content tampering, or broader server compromise if the vulnerable instance is reachable and unremediated.

Failure mechanism: Attackers exploit the web parameter handling flaw to influence application behaviour in ways the developer assumed were immutable, which can open a path to unauthorized actions or deeper compromise.

Impact: Exposure can extend beyond the CMS itself to hosted content integrity, administrative access, and adjacent systems if the application is used as a foothold.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploited CVEs require prioritised scanning and remediation.
Recommendation — Prioritise exposed Craft CMS instances and verify remediation on an urgent cadence.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The question is about an exploited vulnerability and how to confirm exposure.
	SI-2 — Flaw Remediation	Actively exploited flaws require prompt fixing or compensating mitigation.
	IR-4 — Incident Handling	Active exploitation means teams should also check for prior compromise.
Recommendation — Scan for affected Craft CMS assets and track remediation to closure. Apply the vendor fix or approved mitigation as soon as exposure is confirmed. Investigate affected hosts for compromise indicators before returning them to service.
OWASP ASVS	V15 — Secure Architecture	The flaw class concerns web request handling and trust boundary abuse.
Recommendation — Review how the application treats request parameters and harden trust boundaries.

Practitioner Guidance

What to prioritise: Confirm whether any Craft CMS instance is public-facing, then treat patching or compensating control deployment as a same-day task for anything exposed to untrusted networks. If you have multiple web apps, prioritise the ones with external reach, administrative interfaces, or historical exceptions.

What to verify: After remediation, validate that the vulnerable condition is gone and check for signs of earlier compromise, including unexpected admin changes, new files, altered templates, suspicious outbound connections, and recent authentication anomalies.

Decision rule: If patching must wait, reduce exposure immediately and preserve evidence. If you can patch now, do that before spending time on post-incident theories, then hunt for compromise with the assumption that opportunistic exploitation may already have occurred.

Practitioner takeaway: A KEV listing is not a paper exercise, it is a prioritisation trigger, and for an actively exploited CMS flaw the right order is exposure check, fix, then compromise verification.