InfoSecBulletin Cybersecurity for mankind
CISA has added a serious security flaw in the Craft content management system (CMS) to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.
The vulnerability CVE-2025-23209 (CVSS score: 8.1) affects Craft CMS versions 4 and 5. It was fixed by the maintainers in late December 2024 with versions 4.13.8 and 5.5.8.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
“Craft CMS contains a code injection vulnerability that allows for remote code execution as vulnerable versions have compromised user security keys,” the agency said.
The vulnerability affects the following version of the software –
>= 5.0.0-RC1, < 5.5.5
>= 4.0.0-RC1, < 4.13.8
In an advisory released on GitHub, Craft CMS noted that all unpatched versions of Craft with a compromised security key are impacted by the security defect.
“If you can’t update to a patched version, then rotating your security key and ensuring its privacy will help to mitigate the issue,” it noted.
It’s unclear how the user security keys were compromised or the circumstances surrounding it.
FCEB agencies should apply the necessary fixes to reduce the risk from the vulnerability by March 13, 2025.
In December 2024, Craft CMS reported active exploitation of a security flaw (CVE-2024-56145) that allows remote code execution if the PHP register_argc_argv setting is enabled. This vulnerability has not yet been included in CISA’s KEV catalog.
Test this free automated tool to hunt for exposed AWS secrets
