Skip to content
Sign in

n8n product

Several products

Alert
No CISA KEV deadline is open. CISA last added a Several products CVE on 11 Mar.

Tracked since 28 Jan · latest article 30 Jul · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 1 in the full CISA catalogue · all time

2High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date1

Several products CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Several products CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2025-68613n8n11 MarPassed 25 Mar7
Vendor CSV of 1 entry for n8nAll 1 vendor entry, including other products.

Patch cadence and exploit odds

How often CISA adds Several products CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’251Q1 ’260Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20261
Q2 20260
Q3 20260
Q4 20260

Fix listed

3 of 10 CVEs in coverage

7 CVEs have no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2025-68613: 99.9th percentile, in CISA KEVCVE-2026-21858: 99.6th percentileCVE-2026-27577: 95.8th percentileCVE-2026-25049: 75.6th percentileCVE-2026-27493: 72.2th percentileCVE-2026-27497: 59th percentileCVE-2026-27495: 56.4th percentileCVE-2026-25056: 54.5th percentileCVE-2026-25053: 50.3th percentileCVE-2026-59208: 18.4th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2025-6861399.9
CVE-2026-2185899.6
CVE-2026-2757795.8
CVE-2026-2504975.6
CVE-2026-2749372.2
CVE-2026-2749759
CVE-2026-2749556.4
CVE-2026-2505654.5
CVE-2026-2505350.3
CVE-2026-5920818.4

Coverage16 articles · all time

The latest 16 articles naming Several products, in the shared story grammar.

Full timeline
Quiet for 13 weekslast report 30 Jul16 articles9 outlets

16 articles from 9 outlets since 28 Jan. Quiet since 30 Jul.

Now28 Jan111724271315 Jul252First reportThe Hacker News · 28 Jan, 13:30CISA alert11 Mar, 18:34 · officialPicked up againafter 6 days quiet
  • Wed 28 Jan, 13:30 UTC. The Hacker News, first report. Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution.
  • Thu 29 Jan, 22:36 UTC. Dark Reading, its first report on the story. More Critical Flaws on n8n Could Compromise Customer Security.
  • Thu 5 Feb, 06:46 UTC. The Hacker News. Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows.
  • Thu 5 Feb, 11:50 UTC. SecurityWeek, its first report on the story. Critical N8n Sandbox Escape Could Lead to Server Compromise.
  • Thu 5 Feb, 13:35 UTC. SOCRadar, its first report on the story. CVE-2026-25049: n8n Expression Sandbox Escape Enables RCE.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline, its first report on the story. Popular n8n Platform Hit by Triple Threat of RCE Flaws.
  • Wed 11 Mar, 15:17 UTC. The Hacker News. Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials.
  • Wed 11 Mar, 18:34 UTC. CISA, its first report on the story. CISA Adds CVE-2025-68613 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Mar, 18:38 UTC. CISA. CISA Adds CVE-2025-68613 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 06:04 UTC. The Hacker News. CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 10:08 UTC. Security Affairs, its first report on the story. U.S. CISA adds a flaw in n8n to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 10:08 UTC. SecurityWeek. Critical N8n Vulnerabilities Allowed Server Takeover.
  • Thu 12 Mar, 15:41 UTC. Infosecurity, its first report on the story. Critical Zero-Click Flaw in n8n Allows Full Server Compromise.
  • Fri 13 Mar, 14:37 UTC. SecurityWeek. In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 08:11 UTC. SOCRadar. CVE-2026-59208 Flaw Lets Attackers Impersonate n8n Users.
  • Thu 30 Jul, 10:32 UTC. Unit 42, its first report on the story. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 16 articles as a list
  1. Wed 28 JanDay 01
    1. Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution13:30 · The Hacker News · First report
  2. Thu 29 JanDay 11
    1. More Critical Flaws on n8n Could Compromise Customer Security22:36 · Dark Reading

  3. Quiet for 6 days

    Thu 5 FebDay 83
    1. Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows06:46 · The Hacker News · Picked up again
    2. Critical N8n Sandbox Escape Could Lead to Server Compromise11:50 · SecurityWeek
    3. CVE-2026-25049: n8n Expression Sandbox Escape Enables RCE13:35 · SOCRadar
  4. Fri 6 FebDay 91
    1. Popular n8n Platform Hit by Triple Threat of RCE Flaws01:41 · SecurityOnline

  5. Quiet for 5 weeks

    Wed 11 MarDay 423
    1. Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials15:17 · The Hacker News · Picked up again
    2. CISA Adds CVE-2025-68613 to Known Exploited Vulnerabilities Catalogue18:34 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Adds CVE-2025-68613 to Known Exploited Vulnerabilities Catalogue18:38 · CISA · official · Known exploited CVE
  6. Thu 12 MarDay 434
    1. CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed06:04 · The Hacker News · Known exploited CVE
    2. U.S. CISA adds a flaw in n8n to its Known Exploited Vulnerabilities catalog10:08 · Security Affairs · Known exploited CVE
    3. Critical N8n Vulnerabilities Allowed Server Takeover10:08 · SecurityWeek
    4. Critical Zero-Click Flaw in n8n Allows Full Server Compromise15:41 · Infosecurity
  7. Fri 13 MarDay 441
    1. In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown14:37 · SecurityWeek · Known exploited CVE

  8. Quiet for 18 weeks

    Fri 17 JulDay 1701
    1. CVE-2026-59208 Flaw Lets Attackers Impersonate n8n Users08:11 · SOCRadar · Picked up again

  9. Quiet for 13 days

    Thu 30 JulDay 1831
    1. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks10:32 · Unit 42 · Picked up again · Known exploited CVE

All CVEs in coverage10

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2025-68613Exploited

    n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

    10.0Critical99% EPSS · 7 articles
  • CVE-2026-21858

    n8n-io n8n vulnerability

    10.0Critical78% EPSS · 3 articles
  • CVE-2026-27577

    n8n: Expression Sandbox Escape Leads to RCE

    Not scored11% EPSS · 4 articles
  • CVE-2026-25049

    n8n Has an Expression Escape Vulnerability Leading to RCE

    Not scored1.6% EPSS · 4 articles
  • CVE-2026-27493

    n8n has Unauthenticated Expression Evaluation via Form Node

    Not scored1.4% EPSS · 3 articles
  • CVE-2026-27497

    n8n has Potential Remote Code Execution via Merge Node

    Not scored0.9% EPSS · 1 article
  • CVE-2026-27495

    n8n has a Sandbox Escape in its JavaScript Task Runner

    Not scored0.8% EPSS · 1 article
  • CVE-2026-25056

    n8n Arbitrary File Write leading to RCE in n8n Merge Node

    Not scored0.7% EPSS · 1 article
  • CVE-2026-25053

    n8n is Vulnerable to OS Command Injection in Git Node

    Not scored0.6% EPSS · 1 article
  • CVE-2026-59208

    n8n-io n8n vulnerability

    7.6High0.3% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in