Is CVE-2024-58136 (Yiiframework Yii Improper Protection of Alternate Path) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2024-58136 to its Known Exploited Vulnerabilities catalogue on 2 May 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code.

What “being exploited in the wild” means for CVE-2024-58136

For a CVE, “in the wild” means there is credible evidence that attackers are actively using the flaw, not just that it exists in theory or has a proof of concept. For this case, the important operational question is whether your Yii Framework deployment is exposed to the vulnerable alternate path condition and whether any web-facing instance could have been reached before remediation.

The practical reading is simple: treat it as an active exploitation event, not a future risk. If you run Yii Framework, confirm whether the affected application path is present in your environment, then validate whether edge controls, reverse proxies, or application routing could have masked the exposure. The CISA Known Exploited Vulnerabilities Catalog is the authoritative exploitation signal for prioritisation, while the CVE Program and NIST National Vulnerability Database help anchor the record and product identity.

Why alternate-path weaknesses are dangerous in web frameworks

An alternate-path issue matters because the application can appear protected by normal route handling while still accepting a request that reaches sensitive logic through a different path. In a framework, that can turn what looks like a configuration or routing edge case into a remote code execution path, which is why the direct answer’s exploitation status is operationally significant.

What makes this class of flaw especially urgent is that defenders often focus on the “known” route and miss the alternate entry point. Once attackers can reach code execution, the issue stops being only about a vulnerable endpoint and becomes a broader compromise problem: arbitrary command execution, application tampering, and possible follow-on access to credentials, sessions, or adjacent systems.

For tracking and triage, pair the public vulnerability record with exploitation-likelihood and exposure signals. The FIRST EPSS resource helps with likelihood-based prioritisation, but it should not override confirmed exploitation evidence from CISA when making response decisions.

What to do when patching or full remediation is delayed

If you cannot remediate immediately, focus on reducing reachable attack surface and on detecting whether the flaw has already been used. That means restricting public access where possible, checking whether the application is behind strict allowlisting or authentication gates, and verifying whether any compensating control actually blocks the vulnerable path rather than just the normal route.

Because the vulnerability may allow remote code execution, review for signs of compromise before and after remediation. Hunt for unexpected web shell placement, new processes spawned by the web server account, unusual outbound connections, and recent changes to application files, framework components, or deployment artefacts. If the application handled secrets, sessions, or service credentials, rotate the exposed material rather than assuming no theft occurred.

Risk and Threat Considerations

This vulnerability is risky because confirmed exploitation means attackers may already be using the alternate path to reach code execution on exposed Yii Framework instances. The main exposure is not only initial compromise, but also the possibility that web application access led to deeper credential or session theft before defenders noticed.

Failure mechanism: An attacker sends a crafted request that bypasses expected path handling and reaches vulnerable framework logic, allowing arbitrary code execution on the server.

Impact: Treat exposed instances as potentially compromised, then verify file integrity, process activity, and credential exposure, because remote code execution can become a foothold for persistence and lateral movement.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require prioritised discovery, validation, and remediation.
Recommendation — Prioritise detection, confirmation, and remediation of the exposed Yii instance.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The subject is a confirmed exploited vulnerability requiring timely correction and verification.
	SI-4 — System Monitoring	Active exploitation warrants monitoring for suspicious web requests and compromise signs.
Recommendation — Remediate the flaw and verify affected systems are corrected. Monitor logs and host activity for exploitation and post-exploit behaviour.
OWASP ASVS	V15 — Secure Coding and Architecture	Alternate-path execution flaws reflect an application architecture weakness in request handling.
Recommendation — Review route handling and application design for alternate-path exposure.
NIST CSF 2.0	DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events	Exploited CVEs need detection coverage for malicious requests and server-side anomalies.
Recommendation — Detect exploitation attempts and anomalous server-side execution promptly.

Practitioner Guidance

What to verify: Confirm whether any Yii Framework application is reachable on the internet, whether the vulnerable code path is deployed, and whether logs show requests consistent with path traversal or abnormal route resolution.

Decision rule: If the system is externally reachable and the fix is not yet in place, prioritise containment and compromise assessment before waiting for routine maintenance windows. If the application is internal only, still assess whether any trusted partner, VPN user, or proxy can reach it.

What good looks like: You should be able to show that the vulnerable version or path is no longer reachable, that evidence of exploitation was checked, and that any exposed credentials, sessions, or tokens were rotated where needed.

Practitioner takeaway: For KEV-listed web framework flaws, “patched eventually” is not a sufficient response; the real decision is whether you have already contained exposure and ruled out pre-patch compromise.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org