CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed

Summary: CISA added CVE-2025-68613, a CVSS 9.9 expression injection flaw in n8n that allows remote code execution, to its Known Exploited Vulnerabilities catalog on Wednesday based on evidence of active exploitation. n8n patched the flaw in December 2025 in versions 1.120.4, 1.121.1, and 1.122.0, and Shadowserver Foundation data shows more than 24,700 unpatched instances exposed online as of early February 2026, including over 12,300 in North America and 7,800 in Europe.
What you should know: An authenticated attacker who exploits this flaw executes code with the n8n process's privileges, which the maintainers say can mean complete compromise of the instance - and more than 24,700 exposed instances remain unpatched, with FCEB agencies ordered to patch by March 25, 2026.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2025-68613 CVE-2026-27577
Related: n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process Cyber Risks ·
CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability Known Exploited Vulnerabilities · Mar 11, 2026
Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances Cyber Risks ·