CVE-2025-54068 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-07-17

Added to CISA KEV: 2026-03-20 246 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
IMMEDIATE: Upgrade to Livewire v3.6.4 or later immediately
Audit all Laravel applications using Livewire v3 components
Review web application logs for suspicious property update requests
Implement additional web application firewall rules if patching is delayed
Monitor for unusual command execution or file system changes

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-54068 is a critical remote code execution (RCE) vulnerability affecting the Laravel Livewire framework ^[1]?id=CVE-2025-54068?kagi_q=CVE-2025-54068.

Vulnerability Overview

Affected Versions: Livewire v3 up to and including version 3.6.3 ^[1].
Impact: Successful exploitation allows unauthenticated attackers to achieve remote command execution (RCE) on the server hosting the application ^[1]?id=CVE-2025-54068?kagi_q=CVE-2025-54068.
Mitigation: The vulnerability has been patched. Users are advised to update to a secure version of Livewire ^[2].

Attack Method and Requirements

Exploitation Mechanism: The vulnerability exists within the component property update hydration mechanism ^[4]. Attackers can leverage this to perform insecure deserialization or "smuggle" synthesizers to execute arbitrary commands ^[2].
Requirements:

* Network vs. Local: It is a remote vulnerability, meaning it can be exploited over the network without requiring local access ^[1]. * Authentication: The attack is unauthenticated ^[1]. * Complexity: While initial reports suggested a dependency on knowing the application's `APP_KEY`, subsequent research demonstrated that the vulnerability could be exploited by smuggling synthesizers, bypassing the need for the `APP_KEY` entirely ^[2].

Exploitation and Threat Intelligence

Proof-of-Concept (PoC): Publicly available tools, such as "Livepyre," were developed to facilitate the exploitation of this vulnerability ^[3].
Active Exploitation: While the vulnerability is well-documented and has associated exploit tools, there is no widespread public reporting of it being the primary driver for major, named ransomware campaigns as of June 2026. However, due to the nature of RCE vulnerabilities in popular frameworks, it remains a high-value target for automated scanning and opportunistic exploitation by various threat actors.
Targeted Attacks: Given the ease of exploitation, it is highly likely to be used in targeted attacks against vulnerable Laravel applications to gain initial access, establish persistence, or exfiltrate data.

Sources

CVE-2025-54068 Detail - NVD
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to ...
Livewire: remote command execution through unmarshaling
The discovery of CVE-2025-54068 further exposed a critical flaw: the ability to smuggle synthesizers via the updates mechanism, entirely bypassing the need for the APP_KEY. This vulnerability, now patched, forced Livewire to harden its hydration logic by preserving the original snapshot context duri…
GitHub - synacktiv/Livepyre: A tool designed to exploit CVE-2025 ...
A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APP_KEY of the Livewire project is known. - synacktiv/Livepyre.
CVE-2025-54068 - GitHub Advisory Database
Livewire is vulnerable to remote command execution during component property update hydration…