MITRE disclosed a critical remote code execution vulnerability (CVE-2025-27364) in Caldera, its open-source adversary emulation platform.
According to Help Net Security, it affects all versions up to 4.2.0 and 5.0.0 and lets unauthenticated attackers run arbitrary code on the server with a crafted request to the API that compiles and downloads the Sandcat and Manx agents.
The payload is smuggled in through the gcc -extldflags linker flag, and the attack also needs Go, Python and GCC on the server (GCC often arrives as a Go dependency anyway).
Caldera contributor Dawid Kulikowski reported the bug and helped build the fix in Caldera 5.1.0, and the team recommends updating quickly or taking instances off the internet.
Offensive tooling is still software, and software has bugs.
