‼️CVE-2026-25049: N8n AI Workflow Remote Code Execution

"This vulnerability allows an attacker to execute arbitrary system commands through misconfigured or insecure AI workflow execution paths. When chained correctly, it can lead to full server compromise depending on deployment configuration."

Video Credit: youtube.com/@SecureLayer7

Critical n8n flaws (CVE-2026-25049) have been disclosed, allowing authenticated users to achieve remote code execution and gain complete control of the host server by bypassing sanitization mechanisms. Users are advised to update to the latest version (1.123.17 and 2.5.2) and rotate credentials to mitigate these vulnerabilities.
https://www.bleepingcomputer.com/news/security/critical-n8n-flaws-disclosed-along-with-public-exploits/

Yet another critical vulnerability in n8n - CVE-2026-25049 (CVSS 9.4).

Vulnerability detection script here:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-25049.yaml

Patched versions are 1.123.17 / 2.5.2 as per:
https://github.com/n8n-io/n8n/security/advisories/GHSA-6cqr-8cfr-67f8

Angriffe auf Office-Schwachstelle CVE-2026-21509 durch russische APT28 beobachtet.

https://borncity.com/blog/2026/02/04/angriffe-auf-office-schwachstelle-und-auf-outlook/

Why CVSS Scores Don’t Always Reflect an Exploit’s Actual Severity

Today we're covering Operation Neusploit, the advanced cyberespionage campaign identified by Zscaler ThreatLabz attributed with confidence to the Russia-linked APT28 (A.K.A. Fancy Bear) threat group, we're sharing this perspective on its 7.8 score. Neusploit weaponizes CVE-2026-21509, a Microsoft Office zero-day security bypass vulnerablity, to target government and executive organizations in Ukraine,…

https://itnerd.blog/2026/02/04/why-cvss-scores-dont-always-reflect-an-exploits-actual-severity/

🚨 Active exploitation confirmed: CVE-2026-24061.

This isn't just theoretical, it's a massive exposure. With nearly 800,000 Telnet instances exposed globally across legacy IoT and outdated servers, the risk of a root-level compromise is real and immediate.

We have updated Pentest-Tools.com to help you validate your exposure:

📡 Network Scanner - detects exposed Telnet services across your internal and external perimeters, identifying potentially vulnerable GNU Inetutils daemons.

🎯 Sniper Auto-Exploiter - safely executes a proof-of-concept to confirm if the authentication bypass is actually exploitable on your systems, providing the evidence needed to prioritize an immediate fix.

⚠️ Crucial detail: This critical vulnerability exists because telnetd fails to sanitize the USER environment variable. An attacker can simply supply -f root to bypass the login prompt entirely and gain instant, unauthenticated root shell access.

Attacks are happening in real-time. Validate your risk before it becomes a root-level compromise.

#offensivesecurity #ethicalhacking #infosec #cybersecurity

Check out more details about this critical vulnerability: https://pentest-tools.com/vulnerabilities-exploits/telnet-inetutils-authentication-bypass_28759

Detect with Network Scanner: https://pentest-tools.com/network-vulnerability-scanning/network-security-scanner-online

Validate with Sniper Auto-Exploiter: https://pentest-tools.com/exploit-helpers/sniper

Whatever your system is you need to patch in the fix for this CVE:

https://www.cve.org/CVERecord?id=CVE-2026-24061

The attack requires no credentials, no prior system access, and no user interaction.

Geez.

#ReactNative: Critical vulnerability in Metro server for #React Native CVE-2025-11953 allows unauthenticated attackers to execute arbitrary OS commands via a POST request is actively exploited - patch now!
#Metro4Shell
#SoftwareSupplyChainSecurity
👇

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-react-native-metro-bug-to-breach-dev-systems/
https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-react-native-metro-bug-to-breach-dev-systems/

CISA has added CVE-2025-40551, a critical SolarWinds Web Help Desk deserialization vulnerability, to the KEV catalog after confirming active exploitation.

The flaw enables unauthenticated remote code execution and has already been patched, though exploitation details remain undisclosed. Additional KEV inclusions span Sangoma FreePBX and GitLab, reflecting continued abuse of both enterprise and open-source platforms.

This reinforces the importance of KEV-driven prioritization and continuous monitoring beyond initial disclosure.

Source: https://thehackernews.com/2026/02/cisa-adds-actively-exploited-solarwinds.html

Community insight welcome.
Follow TechNadu for ongoing vulnerability and threat intelligence updates.

#Infosec #KEV #CISA #VulnerabilityResearch #SolarWinds #ThreatLandscape #CyberDefense

Only quickly popping on here from an otherwise very nice Fediverse vacation, because NCSC-NL has just put out an “assume-breach” warning. That’s… kinda big.

https://www.ncsc.nl/waarschuwing/ncsc-roept-organisaties-op-zich-te-melden-bij-gebruik-van-ivanti-endpoint-manager (Dutch)

#Ivanti #CVE20261281 #EPMM #MobileIron #NCSC_NL #Cybersecurity #infosec #IOC #NCSC

BSI-Warnung: 2.500 deutsche VMware ESXi-Server im Internet erreichbar; Angriffe über CVE-2025-22225

https://borncity.com/blog/2026/02/04/cert-bund-warnt-2-500-vmware-esxi-server-im-internet-erreichbar/