CVE-2025-27364

MITRE Caldera, an open-source adversary emulation platform, contains a critical unauthenticated remote code execution flaw (CWE-78 command injection) in the server component that dynamically compiles its Sandcat and Manx agent implants. A remote attacker with no credentials can trigger it by sending a crafted web request to the Caldera server API used for compiling and downloading these agents, abusing the gcc -extldflags linker flag to inject and execute sub-commands. Successful exploitation yields arbitrary code execution on the host running Caldera, with the changed scope and high confidentiality/integrity/availability impact indicating full compromise beyond the application itself. All deployments through 4.2.0 and 5.0.0 builds prior to fix commit 35bc06e are affected. Exploitation has not been confirmed in the wild and no public PoC is known, but EPSS assigns a roughly 26% probability of exploitation within 30 days (98th percentile), so defenders should treat it as likely to be targeted soon.

What to do: Upgrade Caldera to a 5.0.0 build at or after commit 35bc06e (the fixed version); deployments on 4.x or unpatched 5.0.0 builds should move to the patched code. Until then, restrict network access to the Caldera server and its agent compile/download API, and check server logs for unauthenticated requests to the Sandcat/Manx compilation endpoint containing gcc -extldflags parameters, followed by host-level review for unexpected command execution.