CVSS—
Severityhigh
Weakness—
EPSS99.8%100.0th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueApr 3, 2026
patch window
Called exploited 7 days before disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing7d
- Last KEV listing11mo
- Last sighting5mo
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Mar 20, 2026
- EUVDENISA, European Unionlisted Mar 20, 2026
- VulnCheck KEVcommercial researchlisted Apr 18, 2025
- CIRCLaggregator, mirrors the abovelisted Mar 20, 2026, not counted
Sources3 of 3
Listings differ by336 d
Strongest claimconfirmed
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationwww.recordedfuture.com/blog/july-2026-cve-landscape
- reported exploitationcyble.com/reports/H1-2026-Global-Threat-Landscape-Report.pdf
- reported exploitationwww.cyber.gov.au/about-us/view-all-content/alerts-and-adviso
- reported exploitationctrlaltintel.com/research/Wordpress/
- reported exploitationwww.recordedfuture.com/blog/march-2026-cve-landscape
- reported exploitationwww.cisa.gov/sites/default/files/feeds/known_exploited_vulne
14 public reports collected from VulnCheck and CIRCL, first on Apr 18, 2025. Each links to its original source. We have not verified them.
Description
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
