Serial number: AV25-300
Date: May 28, 2025
Updated: March 23, 2026
On April 7, 2025, Craft CMS published a security advisory to address a critical vulnerability in the following product:
- Craft CMS – versions prior to 9.15, 4.14.15 and 5.6.17
Craft CMS has received reports that CVE-2025‑32432 has been exploited.
Update 1
On March 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025‑32432 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.
