The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about the active exploitation of a critical remote code execution (RCE) vulnerability affecting the widely used open-source workflow automation platform n8n, which is commonly deployed to automate data ingestion, operational workflows, and integrations across enterprise systems. The flaw, tracked as CVE-2025-68613 (CVSS score of 9.9), stems from improper control of dynamically managed code resources within n8n’s workflow expression evaluation engine, allowing authenticated attackers to inject malicious expressions that are executed without proper validation. Successful exploitation can enable attackers with low-privilege access to gain full control of vulnerable instances, potentially exposing highly sensitive information like API keys, OAuth tokens, database credentials, cloud storage access, and CI/CD secrets. The flaw also allows threat actors to modify automated workflows or execute system-level commands that could introduce malicious code into connected systems and supply chains. Although the vulnerability was patched in n8n version 1.122.0 released in December, security researchers estimate that tens of thousands of instances remain exposed, with some reporting over 40,000 unpatched systems online and others suggesting that more than 100,000 deployments may be vulnerable out of roughly 230,000 active users. Due to confirmed exploitation activity, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and mandated that Federal Civilian Executive Branch (FCEB) agencies patch affected systems by no later than March 25, 2026. CISA also urges all organizations to apply patches or implement mitigations like restricting workflow permissions and limiting system privileges. CTIX analysts urge any affected readers to ensure that their instances are patched, and that any necessary mitigations are applied to prevent exploitation.