A critical remote code execution vulnerability in n8n, tracked as CVE-2025-68613, has been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog due to active exploitation1. This vulnerability, which has a CVSS score of 9.9, allows for expression injection, enabling attackers to execute arbitrary code remotely. With approximately 24,700 instances remaining exposed, the severity of this flaw necessitates immediate attention. The vulnerability was patched, but the exploitation status, as discussed by CISA, dictates whether a patch-now or monitor approach is necessary. Given the high CVSS score and active exploitation, practitioners should prioritize patching or mitigating this vulnerability to prevent potential attacks. The presence of this vulnerability in CISA's catalog highlights the urgency of addressing this security flaw, making it essential for organizations to take prompt action to protect their systems.