{"uuid": "0711d23c-3eb1-4e8f-b143-fca8989d8d1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27577", "type": "seen", "source": "https://t.me/cve0day/274", "content": "Headline: CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed\n\nSummary: The article details a critical remote code execution (RCE) vulnerability (CVE-2025-68613) in the n8n workflow automation platform, added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. The flaw, patched in n8n versions 1.120.4 and later, allows authenticated attackers to execute arbitrary code with host privileges, risking full instance compromise. Over 24,700 unpatched instances remain exposed globally, with significant numbers in North America and Europe. CISA's inclusion follows n8n's disclosure of another critical flaw (CVE-2026-27577) in the same system. Federal agencies under a Binding Operational Directive must patch systems by March 25, 2026, to address risks of data theft, workflow tampering, or system-level access via unmitigated exploitation.\n\nURL: https://thehackernews.com/2026/03/cisa-flags-actively-exploited-n8n-rce.html", "creation_timestamp": "2026-08-28T00:00:41.464216Z"}