CVE-2024-58136

Exploited in the Wild ✓ Confirmed 0-Day

Triaged: March 5, 2026 2 articles

VulnLookup ↗ NVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

78.95%

probability

This CVE has a 78.95% probability of being exploited in the next 30 days.

0% Top 99.1th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Attack Intelligence

CWE-284 · Improper Access Control CWE-285 · Improper Authorization CWE-424 · Improper Protection of Alternate Path CWE-638 CWE-657 · Violation of Secure Design Principles CWE-693 · Protection Mechanism Failure CWE-710 · Improper Adherence to Coding Standards CWE-862 · Missing Authorization

Hackers Exploit Critical Craft CMS Flaws; Hundreds of Servers Likely Compromised

TheHackerNews

Craft CMS RCE exploit chain used in zero-day attacks to steal data

BleepingComputer Apr 25, 2025

Signal Intelligence

Confidenceⓘ

85%

EPSS 78.95%

Mentions 2

Last Seen Apr 25, 2025

CNA Information

Analyst Note

CVE-2024-58136 explicitly states exploitation 'in the wild in February through April 2025' with CVE published 2025-04-10, indicating active attacks preceded or coincided with patch availability. However, lack of Google Project Zero or CISA KEV listing and limited article coverage slightly reduces confidence from maximum.

Triage Info

Decided atMar 05, 2026