<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle22
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:159734357;
mso-list-template-ids:1664517694;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:1045253507;
mso-list-type:hybrid;
mso-list-template-ids:-889014640 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l2
{mso-list-id:1232422882;
mso-list-type:hybrid;
mso-list-template-ids:-477205066 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l3
{mso-list-id:2051998296;
mso-list-template-ids:1084125954;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4
{mso-list-id:2094233095;
mso-list-type:hybrid;
mso-list-template-ids:-1855551814 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l4:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l4:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l4:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l4:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l4:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Good morning,<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">The SOC Services team is reporting on the vulnerability: CVE-2025-32432 affecting Craft is a flexible, user-friendly CMS for creating custom digital experiences on
the web and beyond. Because public disclosure of a high-impact privilege escalation vulnerability with proof-of-concept availability, we are providing this in-depth information.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">History</span></u></b><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">On April 7, 2025, Craft CMS receives a report detailing a dependency issue in the Yii framework, related to pre-authenticated code injection. NVD published
the CVE on 4/25/2025 and last modified on 3/20/2026. A CVSS v3.x base score is 10.0 (Critical) was assigned by NIST.</span><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Affected Versions</span></b><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></b></p>
<ul type="disc">
<li class="MsoListParagraph" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-list:l4 level1 lfo1;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Version 3.0.0-RC1 to 3.9.14</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-list:l4 level1 lfo1;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Version 4.0.0-RC1 to 4.14.14</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-list:l4 level1 lfo1;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Version 5.0.0-RC1 to 5.6.6</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></li></ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Fixed Versions</span></b><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></b></p>
<ul type="disc">
<li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l3 level1 lfo2;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Version 3.9.15<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l3 level1 lfo2;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Version 4.14.15<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l3 level1 lfo2;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Version 5.6.17<o:p></o:p></span></li></ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">The vendor has provided a knowledge base article regarding this vulnerability and is posted on their website<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Vendor Advisory: <a href="https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432">Craft CMS and CVE-2025-32432</a><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Intelligence:</span></u></b><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">On March 19, 2026, CISA has listed the vulnerability in the Known Exploited Vulnerabilities Catalog.</span><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Exploitability Level:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none"> Low Complexity, Network Exploitability<br>
<b>Complexity:</b> Low<br>
<b>User Interaction:</b> None<br>
<b>Remotely Exploitable:</b> Yes<br>
<b>Proof of Concept:</b> Yes<br>
<b>Zero Day:</b> Yes<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Workarounds:</span></u></b><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></p>
<ul type="disc">
<li class="MsoListParagraph" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-list:l1 level1 lfo3;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Block suspicious POST requests to the 'actions/assets/generate-transform' endpoint at the firewall.<o:p></o:p></span></li><li class="MsoListParagraph" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-list:l1 level1 lfo3;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Install the Craft CMS Security Patches library as a temporary workaround for those unable to update.<o:p></o:p></span></li></ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">How it Works:</span></u></b><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Craft CMS mistakenly allows untrusted JSON/array data to be passed directly to createObject() via the AssetsController::actionGenerateTransform endpoint.
This leads to a classic object injection vulnerability—essentially an “insecure deserialization” problem in the Yii2 DI container</span><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Post-Exploit Impact:</span></u></b><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></p>
<ul type="disc">
<li class="MsoListParagraph" style="color:#003366;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-list:l2 level1 lfo4;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">CWE</span><span style="font-size:11.0pt;font-family:"Cambria Math",serif;color:black;mso-ligatures:none">‑</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">94:
Improper Control of Generation of Code (‘Code Injection’)</span><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></li></ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Indicators of Compromise (IoCs):</span></u></b><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="1440" style="width:15.0in;background:white;border-collapse:collapse">
<tbody>
<tr>
<td style="border:solid #CCCCCC 1.0pt;background:#F2F2F2;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" style="margin-top:12.0pt"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Type<o:p></o:p></span></b></p>
</td>
<td width="641" style="width:480.5pt;border:solid #CCCCCC 1.0pt;border-left:none;background:#F2F2F2;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" style="margin-top:12.0pt"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Value<o:p></o:p></span></b></p>
</td>
<td width="679" style="width:508.9pt;border:solid #CCCCCC 1.0pt;border-left:none;background:#F2F2F2;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" style="margin-top:12.0pt"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Description / Notes<o:p></o:p></span></b></p>
</td>
</tr>
<tr>
<td style="border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" style="margin-top:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Log Artifact<o:p></o:p></span></p>
</td>
<td width="641" style="width:480.5pt;border-top:none;border-left:none;border-bottom:solid #CCCCCC 1.0pt;border-right:solid #CCCCCC 1.0pt;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" style="margin-top:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">/index.php?p=admin/actions/assets/generate-transform containing __class, as session, or as hack.<o:p></o:p></span></p>
</td>
<td width="679" style="width:508.9pt;border-top:none;border-left:none;border-bottom:solid #CCCCCC 1.0pt;border-right:solid #CCCCCC 1.0pt;padding:6.0pt 6.0pt 6.0pt 6.0pt">
</td>
</tr>
<tr>
<td style="border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" style="margin-top:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Malicious IP<o:p></o:p></span></p>
</td>
<td width="641" style="width:480.5pt;border-top:none;border-left:none;border-bottom:solid #CCCCCC 1.0pt;border-right:solid #CCCCCC 1.0pt;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" style="margin-top:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">103.106.66.123<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-top:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">172.86.113.137 and 104.161.32.11<o:p></o:p></span></p>
</td>
<td width="679" style="width:508.9pt;border-top:none;border-left:none;border-bottom:solid #CCCCCC 1.0pt;border-right:solid #CCCCCC 1.0pt;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" style="margin-top:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Used to probe asset IDs and test exploitability via python-requests/2.27.1
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-top:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Used to download and delete the filemanager.php backdoor<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Tenable Plugins:</span></u></b><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="1452" style="width:1088.95pt;background:white;border-collapse:collapse">
<tbody>
<tr>
<td width="95" style="width:71.6pt;border:solid windowtext 1.0pt;background:#F2F2F2;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" align="center" style="margin-top:12.0pt;text-align:center"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Plugin ID<o:p></o:p></span></b></p>
</td>
<td width="462" style="width:346.5pt;border:solid windowtext 1.0pt;border-left:none;background:#F2F2F2;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" align="center" style="margin-top:12.0pt;text-align:center"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Plugin Title<o:p></o:p></span></b></p>
</td>
<td width="288" style="width:3.0in;border:solid windowtext 1.0pt;border-left:none;background:#F2F2F2;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" align="center" style="margin-top:12.0pt;text-align:center"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Severity<o:p></o:p></span></b></p>
</td>
<td width="606" valign="top" style="width:454.85pt;border:solid windowtext 1.0pt;border-left:none;background:#F2F2F2;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" align="center" style="margin-top:12.0pt;text-align:center"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Platform<o:p></o:p></span></b></p>
</td>
</tr>
<tr>
<td width="95" style="width:71.6pt;border:solid windowtext 1.0pt;border-top:none;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" align="center" style="margin-top:12.0pt;text-align:center"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">114786<o:p></o:p></span></p>
</td>
<td width="462" style="width:346.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" align="center" style="margin-top:12.0pt;text-align:center"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 Remote Code Execution<o:p></o:p></span></p>
</td>
<td width="288" style="width:3.0in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:6.0pt 6.0pt 6.0pt 6.0pt">
<p class="MsoNormal" align="center" style="margin-top:12.0pt;text-align:center"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Critical<o:p></o:p></span></p>
</td>
<td width="606" valign="top" style="width:454.85pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;background:transparent;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" align="center" style="margin-top:12.0pt;text-align:center"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Web Application Scanning<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Recommended Actions:</span></u></b><b><u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none"><o:p></o:p></span></u></b></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">Date Added to KEV Catalog:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-ligatures:none">03/19/2026<br>
<b>Due Date for Remediation: </b>04/03/2026<o:p></o:p></span></p>
<ul type="disc">
<li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo5;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Update to Craft CMS versions 3.9.15, 4.14.15, or 5.6.17 to vulnerable systems after testing<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo5;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Investigate for signs of compromise by reviewing web server logs for suspicious POST requests to the 'actions/assets/generate-transform' endpoint and checking for malicious files
such as 'filemanager.php' or 'autoload_classmap.php' on the filesystem<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo5;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">If compromise is suspected, refresh the security key, rotate private keys and database credentials, and force a password reset for all users<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo5;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Run all software as a non-privileged user to reduce the impact of a successful attack.<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo5;background:white">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none">Apply the Principle of Least Privilege to all systems and services.<o:p></o:p></span></li></ul>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="702" style="width:526.5pt;border-collapse:collapse">
<tbody>
<tr style="height:63.0pt">
<td width="118" valign="top" style="width:88.35pt;padding:0in 4.65pt 0in 4.65pt;height:63.0pt">
<p class="MsoNormal" style="line-height:105%"><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;color:#1F497D;mso-ligatures:none;mso-fareast-language:ZH-CN"><img border="0" width="121" height="87" style="width:1.2604in;height:.9062in" id="Picture_x0020_4" src="cid:image001.png@01DCB850.45C14220"></span><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;color:#1F497D;mso-ligatures:none;mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
</td>
<td width="493" valign="top" style="width:369.65pt;padding:0in 4.65pt 0in 4.65pt;height:63.0pt">
<p class="MsoNormal" style="line-height:105%"><b><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-language:ZH-CN">Cyber Security Services<o:p></o:p></span></b></p>
<p class="MsoNormal" style="line-height:105%"><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-language:ZH-CN">State of Oregon Cyber Security Services<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:105%"><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-language:ZH-CN">Enterprise Information Services | SOC<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:105%"><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-language:ZH-CN">Cyber Security Services (CSS)<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:105%"><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-language:ZH-CN">SOC Hotline: (503) 378-5930 | SOC Services (503) 373-0378<span style="color:#1F497D"><o:p></o:p></span></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>