Exploited vulnerabilitiesBriefConfirmed by two or more outlets
n8n “Ni8mare” (CVE-2026-21858) chained with CVE-2025-68613
CVSS 10. Unauthenticated file read through form workflows, leading to admin access and then RCE through the expression-injection bug CVE-2025-68613.
- Disclosed
What happened (automation and AI-agent platform)
- Fixed: n8n 1.121.0 or later.
- Exploited: honeypot hits from 9 Jan 2026. CVE-2025-68613 in KEV 11 Mar 2026. CVE-2026-21858 itself was not seen in KEV.
Live scores
Live scores
CVE-2025-68613- EPSS
- 0.990
very likely to be attacked soon - VEDAS
- 0.985
strong exploit evidence - On CISA KEV
- Yes, since 2026-03-11
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 73 days before CISA confirmed attacks.
Live scores
CVE-2026-21858- EPSS
- 0.782
very likely to be attacked soon - VEDAS
- 0.988
strong exploit evidence - On CISA KEV
- Not listed
Sources
- https://www.rapid7.com/blog/post/etr-ni8mare-n8scape-flaws-multiple-critical-vulnerabilities-affecting-n8n/
- https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-lets-hackers-hijack-n8n-servers
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.