U.S. CISA adds Yii Framework and Commvault Command Center flaws to its Known Exploited Vulnerabilities catalog

Yii 2 versions before 2.0.52 mishandle the attaching of behaviors defined with an __class array key, reintroducing the flaw fixed for CVE-2024-4990, an unauthenticated remote code execution issue (CWE-424, improper protection of alternate path). The defect is triggered remotely without authentication when a vulnerable application attaches behaviors this way, giving an attacker high-impact code execution (CVSS 9.8). Any application built on a vulnerable Yii 2 release is affected, most prominently Craft CMS sites, which were the target of an observed in-the-wild campaign between February and April 2025. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-02, carries an 84.6% EPSS probability of exploitation within 30 days, and a public SensePost writeup documents the active Craft CMS exploitation campaign. The top headline reports that hundreds of servers were likely compromised in that campaign.

Do: Upgrade Yii 2 to version 2.0.52 or later; Craft CMS operators should immediately update Craft CMS to its patched release that bundles fixed Yii, and confirm the resolved framework version on the system. Because the campaign ran from February through April 2025, review web/application logs and hosted files for indicators from the SensePost writeup, treating any unpatched internet-facing Yii 2 or Craft CMS host as likely compromised. Federal agencies must apply the KEV required action (vendor mitigations or BOD 22-01 guidance) by the CISA deadline.

Craft CMS contains a code injection vulnerability (CWE-94) that allows a remote attacker to execute arbitrary code on affected servers. CISA's listing does not specify the exact attack path or authentication requirements, but the flaw is remotely triggerable and grants arbitrary code execution, which typically means full compromise of the web server and a foothold for follow-on activity such as ransomware (ransomware use is not yet confirmed). Any organization running a Craft CMS instance is in scope, including internet-facing content sites and deployments where the Craft admin panel is reachable from the internet. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-20, confirming exploitation in the wild, and EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), although no public proof-of-concept is known. No CVSS score has been published yet, so defenders should treat the flaw as urgent given the KEV listing and near-certain EPSS likelihood.

Do: Apply the patched Craft CMS release per the vendor's security advisory referenced in CISA's KEV entry (specific fixed version numbers are not provided in the source data), prioritizing internet-exposed instances, and U.S. federal agencies should follow BOD 22-01 requirements for KEV-listed flaws. Until patched, restrict network access to the Craft CMS control panel/admin interface and review web and application logs for signs of code injection or unexpected process execution, since exploitation in the wild is confirmed while ransomware use remains unknown. Given the 99.8% EPSS score and KEV listing, treat discovery and patching of all Craft CMS instances, including headless deployments, as an urgent, time-boxed task.

Commvault Command Center (Innovation Release 11.38.0 through 11.38.20) is vulnerable to a path traversal flaw (CWE-22) that requires no authentication (CWE-306). An unauthenticated remote attacker uploads a maliciously crafted ZIP file masquerading as an install package to the Command Center web interface; when the target server expands the archive, path traversal lets attacker-controlled files, including malicious JSP webshells, be written outside the intended location. The result is unauthenticated remote code execution on the backup management server, giving attackers a foothold in a core enterprise data-protection component. Any organization running the affected 11.38 release train of Command Center is exposed, particularly if the console is reachable from the internet. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-02, carries a 97.7% EPSS exploitation probability, and public PoC exploit code is available.

Do: Upgrade Command Center to 11.38.20 with hotfixes SP38-CU20-433 and SP38-CU20-436, or to 11.38.25 with SP38-CU25-434 and SP38-CU25-438. Until patched, restrict internet exposure of the Command Center web console and check for signs of compromise such as unexpected JSP files or webshells written by the application. Federal agencies must apply vendor mitigations per CISA BOD 22-01 guidance or discontinue use of the product.