What is the CVSS score of CVE-2026-32264?

CVE-2026-32264 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-32264?

A critical vulnerability in Craft CMS allows authenticated administrators to execute arbitrary code on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-32264?

Within 24 hours: Inventory all Craft CMS installations and identify affected versions (pre-4.17.5 and pre-5.9.11). Within 7 days: Apply vendor patches to upgrade to Craft 4.17.5 or 5.9.11 in development/staging environments and validate functionality. Within 30 days: Deploy patched versions to all production systems and restrict control panel administrator access to trusted personnel only.

PHP CVE-2026-32264

EUVD-2026-12506 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-03-16 https://github.com/craftcms/cms

GHSA-4484-8v2f-5748

PHP Information Disclosure

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 18:32 euvd

EUVD-2026-12506

Analysis Generated

Mar 16, 2026 - 18:32 vuln.today

Patch released

Mar 16, 2026 - 18:32 nvd

Patch available

CVE Published

Mar 16, 2026 - 18:13 nvd

HIGH 7.2

DescriptionGitHub Advisory

The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched src/services/Fields.php, but the same vulnerable pattern exists in ElementIndexesController and FieldsController.

You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.

AnalysisAI

Remote code execution in Craft CMS allows authenticated administrators with control panel access to execute arbitrary code by exploiting an incomplete patch that left the same vulnerable gadget chain pattern in multiple controllers. The vulnerability requires administrative privileges and the allowAdminChanges setting to be enabled, limiting exposure to trusted users with elevated access. Craft CMS versions before 4.17.5 and 5.9.11 are affected and should be patched immediately.

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication.

RemediationAI

A vendor patch is available — apply it immediately. Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.