CISA Flags Active n8n Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency added an n8n vulnerability to its Known Exploited Vulnerabilities catalog on March 11, 2026. The flaw allows remote code execution on systems running the workflow automation platform.
CISA's directive came after confirming active exploitation in the wild. The agency didn't specify which threat groups are behind the attacks or provide details about the attack campaigns. The Hacker News reported the addition to the KEV catalog Wednesday evening.
Federal Agencies Face Patch Deadline
All federal civilian executive branch agencies must patch their n8n installations by March 25, 2026. The 14-day remediation window follows CISA's standard timeline for actively exploited vulnerabilities.
Private sector organizations using n8n aren't bound by the federal directive but should prioritize patching given the confirmed exploitation. The workflow platform is commonly used for automating business processes and integrating different software systems.
Immediate Patching Required
Organizations should update their n8n installations immediately to prevent potential compromise. The remote code execution capability gives attackers significant control over vulnerable systems.
CISA's KEV catalog serves as the authoritative list of vulnerabilities that pose the greatest risk to federal networks. The agency only adds flaws with confirmed exploitation evidence, making this a high-priority security issue for all n8n users.
