5 posts
The Q1 2026 vulnerability landscape shows a continued rise in overall CVEs and KEVs, with a significant focus on software supply chain compromises and networking gear. A notable emerging threat is the abuse of the n8n AI workflow automation platform to bypass traditional security filters, alongside the discovery of the PowMix botnet targeting Czech workers and ongoing exploitation of legacy vulnerabilities.
Threat actors are increasingly abusing the n8n AI workflow automation platform by leveraging its webhook functionality to bypass traditional security filters. These webhooks are embedded in phishing emails to serve CAPTCHA-protected malware payloads, including modified Datto and ITarian RMM tools, or to deploy invisible tracking pixels for device fingerprinting and reconnaissance.
In March 2026, 31 high-impact vulnerabilities were actively exploited, highlighted by the Interlock Ransomware Group leveraging a CVSS 10.0 zero-day in Cisco Secure FMC (CVE-2026-20131). The attackers utilized insecure Java deserialization to gain root access, deploying custom RATs, memory-resident web shells, and ransomware across enterprise networks.
CISA has added CVE-2025-68613, an Improper Control of Dynamically-Managed Code Resources vulnerability in n8n, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. Organizations are strongly urged to prioritize remediation to reduce exposure to cyberattacks.
The Canadian Centre for Cyber Security has issued an alert regarding multiple high-severity vulnerabilities in n8n workflow automation software. These flaws, including improper input validation and code injection, can be chained by unauthenticated attackers to achieve remote code execution, with public Proof-of-Concept exploits already available.
