At a glance
Actively exploited in the wild — prioritise confirming exposure.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Laravel, treat it as High.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Do we run Laravel, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 12 Nov?
Next steps
- Confirm exposure, mitigation status and any service interruption risk.
Vulnerability facts
Full CVE detail CVE-2025-54068- 9.2 · CriticalExploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Listed: attacks using it have been seen (on the catalogue since )
- Elevated attack likelihood (~96.3% in 30 days)
- v3.6.3 and earlier
No technical write-up beyond these facts and the summary below yet.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
- CVE-2025-54068 is listed in known-exploited catalogue (exploitation in the wild)
- Authoritative catalogues report active exploitation of this vulnerability.
Why this matters in the UK
- Known-exploited catalogue reports exploitation in the wild
Products and services involved
- Laravel93% match confidence · CVE-2025-54068
Pulse
Last checked 23m ago · Next recheck 10 Nov 2026, 04:37 UK time · 2 quiet checks collapsed
Suggested changed to 7d.
Listed on the — prioritise confirming exposure and patching.
4 quiet checks hidden.
Sources
Laravel Livewire Code Injection Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
Laravel Livewire Code Injection Vulnerability
- ConfirmedSummary fact75% confidence
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. Affects Laravel Livewire. Known ransomware campaign use: Unknown. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-54068
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2025-54068 is listed in known-exploited catalogue (exploitation in the wild)