Signal
CISA warns of active exploitation of critical n8n remote code execution vulnerability
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-03-11 14:51 UTCUpdated 2026-03-12 13:34 UTC
rss
cveexploitssecurity_advisoryincident_response
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (3 domains)domains are deduped. counts indicate coverage, not truth.3 top sources shown
Overview
The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a critical remote code execution (RCE) vulnerability in the n8n workflow automation platform.
Entities
n8nCybersecurity and Infrastructure Security AgencyCanadian Centre for Cyber Security
Score total
1.28
Momentum 24h
3
Posts
3
Origins
3
Source types
1
Duplicate ratio
0%
Why now
- CISA has just added the vulnerability to its Known Exploited Vulnerabilities list.
- Federal patching orders have been issued to mitigate ongoing attacks.
- The advisory updates from n8n and Canadian Cyber Security emphasize urgency.
Why it matters
- The vulnerability allows remote code execution, risking full system compromise.
- Active exploitation means unpatched systems are at immediate risk.
- Federal agencies and users must patch promptly to prevent breaches.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- A critical remote code execution vulnerability in n8n is actively exploited in the wild.
- CISA has added CVE-2025-68613 to its Known Exploited Vulnerabilities database and ordered federal agencies to patch affected systems.
How sources frame it
- CISA: neutral
- Canadian Centre For Cyber Security: neutral
This briefing highlights the critical n8n RCE vulnerability actively exploited in the wild and the coordinated response by CISA and Canadian Cyber Security urging immediate patching.
All evidence
All evidence
CISA warns max-severity n8n bug is being exploited in the wild
The Register Security · go.theregister.com · 2026-03-12 13:34 UTC
n8n security advisory (AV25-857) – Update 1
Canadian Centre for Cyber Security - Alerts · cyber.gc.ca · 2026-03-11 20:31 UTC
CISA orders feds to patch n8n RCE flaw exploited in attacks
bleepingcomputer_all · bleepingcomputer.com · 2026-03-11 18:21 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 0
Top publishers (this list)
- The Register Security (1)
- Canadian Centre for Cyber Security - Alerts (1)
- bleepingcomputer_all (1)
Top origin domains (this list)
- go.theregister.com (1)
- cyber.gc.ca (1)
- bleepingcomputer.com (1)