Yes. CISA added CVE-2025-32432 to its Known Exploited Vulnerabilities catalogue on 20 March 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. Any organisation running the affected product should treat remediation as urgent.
What “exploited in the wild” means for this CVE
For a vulnerability like CVE-2025-32432, “exploited in the wild” means the issue has moved beyond theoretical proof-of-concept use or lab testing. CISA’s KEV listing is a strong operational signal that exploitation is credible enough to justify urgent action, not just routine patch planning. The practical question is whether your Craft CMS estate is exposed today and whether attacker activity may already have begun.
That changes the response from “patch when convenient” to “treat as an active intrusion path until proven otherwise.” When a remote code execution path exists in a public-facing content platform, the risk is not limited to the application itself. It can become a foothold for broader server compromise, web shell placement, credential harvesting, and lateral movement into adjacent systems.
How to confirm whether you are exposed
Start with inventory and ownership, then confirm whether any internet-facing or externally reachable Craft CMS instance is present in production, staging, or forgotten test environments. Exposure checks should include hosted copies, cloned environments, and application instances that have been left running after migration, because those are common blind spots when a CMS is treated as “just a website.”
Once you identify candidate instances, validate them against the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog entry for this CVE, then correlate with your asset list, CMS version records, and deployment history. If the product is present but ownership is unclear, treat that as exposure until resolved. For prioritisation, combine KEV status with whether the instance is reachable from the internet and whether it contains authenticated admin access.
If your environment uses a broader vulnerability management process, the same urgency logic should apply to any KEV item that enables code execution. The Zero-Day and Exploited Vulnerabilities Guide and the Vulnerability Management Guide both reinforce the same practitioner pattern, verify exposure first, then move fast on remediation and post-fix validation.
What to do before and after remediation
Apply the vendor fix or mitigation as soon as you can, but do not stop at installation. For a code injection issue, the operational question is whether attackers had time to execute commands, drop files, or modify configuration before the fix landed. If the CMS is business-critical and patching must wait, isolate the system, reduce reachability, and narrow administrative access until the window closes.
After remediation, inspect for compromise indicators that fit a web RCE path: unexpected PHP files, altered templates, suspicious admin changes, new scheduled tasks, unusual outbound connections, and logs showing strange request patterns before the KEV date. Review authentication logs, web server logs, and any file integrity signals that can reveal post-exploitation persistence. If the application handles privileged sessions or service credentials, rotate anything that could have been exposed through the compromised host.
Where internet-facing code execution is involved, a useful comparison is how attackers exploit other CMS and web platform flaws to maintain access even after patching. The pattern is the same across many incidents, initial exploit, foothold, persistence attempt, then cleanup that is incomplete unless defenders check for secondary artifacts as well as the CVE itself.
Risk and Threat Considerations
CVE-2025-32432 matters because a remote code injection flaw in a CMS can turn a content publishing platform into an execution point for the attacker. That creates direct compromise risk for the host and indirect risk for any connected identity, secrets, or deployment material stored on the same system.
Failure mechanism: An attacker sends crafted requests that trigger code execution in Craft CMS, then uses that execution to plant persistence, steal data, or pivot into other systems before defenders notice the abnormal activity.
Impact: The likely consequences include full application compromise, website defacement, data theft, credential exposure, and a broader incident if the server has trust relationships with internal services or deployment pipelines.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed code injection requires rapid identification and remediation of exposed systems. |
| Recommendation — Prioritise and remediate the Craft CMS exposure immediately, then verify the fix on every instance. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and recorded | Confirmed exploitation requires exposure confirmation and asset-level vulnerability tracking. |
| Recommendation — Confirm whether any Craft CMS asset is exposed and record the vulnerable instances for urgent action. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Code injection reflects a web application architecture and input-handling failure with exploitability implications. |
| Recommendation — Review the application design and input-handling path that allowed code injection to occur. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Post-exploitation code execution can expose credentials, tokens, or other secrets on the host. |
| Recommendation — Rotate any secrets that may have been accessible on the compromised Craft CMS host. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | The CVE is an internet-reachable code injection path that maps to public-facing application exploitation. |
| Recommendation — Hunt for exploit attempts and web-shell activity on exposed Craft CMS instances. | ||
Practitioner Guidance
What to prioritise: Prioritise any internet-facing Craft CMS instance with administrative access or with access to secrets, deployment credentials, or shared infrastructure. Those systems have the highest blast radius if exploitation already occurred.
What to verify: Verify not only that the patch or mitigation is applied, but also that no attacker-owned files, scheduled jobs, or unexpected configuration changes remain. A clean version number alone is not proof of a clean host.
Escalation / exception: If patching must wait, treat the system as an active exception requiring compensating controls, tighter reachability, and explicit monitoring until the fix is in place.
Practitioner takeaway: KEV inclusion means you should assume exploitation is plausible now, so the real decision is not whether to act, but how quickly you can close exposure and validate that the host was not already used as an entry point.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org