n8n Improper Control of Dynamically-Managed Code Resources Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
High rather than Critical: exposure is scored at a default because we cannot see your systems or suppliers. If it touches your systems or suppliers, treat it as Critical.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Are we affected by CVE-2025-68613, and which of our systems would be?
- Have we checked whether it has already been used against us?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm exposure, mitigation status and any service interruption risk.
Vulnerability facts
Full CVE detail CVE-2025-68613- 9.9 · CriticalExploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Listed: attacks using it have been seen (on the catalogue since )
- Elevated attack likelihood (~99% in 30 days)
- Before 1.120.4, 0.211.0 and earlier
- 1.120.4
Versions are as the CVE record states them; check the vendor advisory before planning a fix.
- CVE-2025-68613 has estimated attack likelihood 0.97875 (~97.9% estimated chance of exploitation in 30 days; 99.9th percentile) as of 2026-07-31 — probability signal, not confirmed exploitation
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- N8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
- CVE-2025-68613 is listed in known-exploited catalogue (exploitation in the wild)
- 9% estimated chance of exploitation in 30 days; 99.
- Authoritative catalogues report active exploitation of this vulnerability.
Why this matters in the UK
- Known-exploited catalogue reports exploitation in the wild
Part of Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Pulse
Last checked 4d ago · Recheck overdue since 5 Nov 2026, 21:36 UK time · 3 quiet checks collapsed
held at 97.9%; ranking metadata was updated.
Listed on the — prioritise confirming exposure and patching.
2 quiet checks hidden.
Sources
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
N8n Improper Control of Dynamically-Managed Code Resources Vulnerability
- ConfirmedSummary fact75% confidence
N8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution. Affects n8n n8n. Known ransomware campaign use: Unknown. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-68613
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2025-68613 is listed in known-exploited catalogue (exploitation in the wild)
- ConfirmedEstimated attack likelihood95% confidence
CVE-2025-68613 has estimated attack likelihood 0.97875 (~97.9% estimated chance of exploitation in 30 days; 99.9th percentile) as of 2026-07-31 — probability signal, not confirmed exploitation