Craft CMS, the flexible content management platform used to build custom digital experiences, carries a confirmed-exploited remote code execution vulnerability tracked as CVE-2025-32432, added to CISA's Known Exploited Vulnerabilities catalogue on 20 March 2026. It scores a perfect 10.0 on CVSS 3.1, the maximum possible severity rating, and it is a low-complexity, no-authentication, no-user-interaction attack — the combination that defines the most dangerous class of internet-facing vulnerability.
Why this CVE is really the second half of a story that started in 2023
The single most important detail in this vulnerability's NVD description is easy to miss: the entry explicitly states that CVE-2025-32432 "is an additional fix for CVE-2023-41892." That means this isn't a fresh, unrelated flaw discovered independently — it's a continuation of a prior remediation that turned out to be incomplete. CVE-2023-41892 was itself a serious Craft CMS remote code execution vulnerability from 2023, and the fact that a follow-on CVE was still necessary roughly two years later, patched across three major version lines simultaneously (3.9.15, 4.14.15, and 5.6.17), tells you the original fix closed one exploitation path without closing the underlying weakness completely. This pattern — an initial patch that addresses the reported proof-of-concept but leaves the broader vulnerability class intact — recurs across software of every kind, but it's particularly consequential in a CMS platform where the same vulnerable code path likely persisted, unnoticed, across multiple version branches for years.
The vulnerability itself is classified as CWE-94, code injection, with NVD noting it as "a high-impact, low-complexity attack vector." That phrase is doing real work: low complexity means an attacker doesn't need specialized conditions, timing, or a chain of intermediate steps to exploit it, and high impact means successful exploitation likely leads directly to remote code execution on the underlying server. The CVSS vector confirms this reading — network attack vector, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality and integrity, with a changed scope (S:C) indicating the compromise can extend beyond the vulnerable component itself.
Why the multi-version-line patch is itself informative
Broadcom's and other vendors' cluster vulnerabilities in this series often affect a single current product line. Craft CMS's fix here spans three major version lines — 3.x, 4.x, and 5.x — simultaneously, which means the underlying code injection weakness was present across years of the product's evolution rather than being introduced in a single recent release. Any organization running Craft CMS needs to verify their specific major version's patched build number individually; simply being on a "recent" install is not the same as being on a patched one, since each of the three lines received its own distinct fix version.
What to check this week
Verify your Craft CMS installation's exact version against the three patched releases — 3.9.15, 4.14.15, or 5.6.17 depending on your major version line — rather than assuming a recent installation is automatically safe, given the vulnerability spans multiple version branches going back years.
Treat this as urgent regardless of your last Craft CMS security review date, since the perfect 10.0 CVSS score combined with confirmed active exploitation places it in the smallest and most dangerous category of vulnerabilities tracked in KEV.
Review server logs for signs of code injection attempts predating your patch date, particularly if your installation predates March 2026, since confirmed exploitation in the wild means attackers were actively probing for this specific weakness before and around the KEV listing date.
Cross-reference this fix against your CVE-2023-41892 remediation history if your organization tracked that earlier vulnerability — teams that patched only the original 2023 disclosure and never revisited it may have a false sense of closure on what was, per NVD's own description, an incomplete fix.
A closing note on "additional fix" as a category of finding
When a vendor's own vulnerability record describes a new CVE as an additional fix for an older one, it's a direct signal that the underlying root cause took more than one patch cycle to fully close. Organizations that track vulnerability remediation as a checklist — patched, closed, done — should treat any "additional fix" disclosure as a prompt to revisit whether their original remediation was ever actually complete, rather than assuming the newer CVE is unrelated housekeeping.
A final consideration on content management platforms as attacker targets
CMS platforms sit at a uniquely exposed position: they're internet-facing by design, they often hold administrative credentials with write access to a public-facing site, and a successful remote code execution exploit against one typically yields not just data but a foothold for defacement, further pivoting, or supply-chain-style abuse of the site's visitors. A perfect-severity, confirmed-exploited RCE in a CMS used to build custom digital experiences across a wide range of organizations deserves the same urgency as any other perimeter-facing critical finding.
How Safeguard helps
Safeguard's continuous inventory tracks content management platforms like Craft CMS across an organization's web-facing footprint, flagging version and patch status against exactly the kind of maximum-severity, confirmed-exploited finding this CVE represents, so remediation doesn't depend on someone remembering to revisit a two-year-old patch history on their own.
