CVE-2025-68924: UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation

Should you act?

Normal patch cycle

No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.8%, percentile 55: FIRST’s model estimates a 0.8% chance of exploitation activity in the next 30 days, higher than 55% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes UmbracoForms (NuGet) <= 8.13.16, no fixed version listed. Check your lockfile, including transitive dependencies.

What it is

In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.

From the GitHub advisory

Impact Within Umbraco Forms, configuring a malicious URL on the Webservice data source can result in Remote Code Execution. This affects all Umbraco Forms versions running on .NET Framework (up to and including version 8).

Patches The affected Umbraco Forms versions are all End-of-Life (EOL) and not supported anymore, hence no patches will be released. Upgrading to any of the currently supported versions (v13, v16 or v17) is recommended.

Workarounds If none of the configured Forms data sources uses the Webservice type, it can be safely excluded by adding the following code to the application. This will completely remove the option to select/use this data source within the Backoffice and thereby mitigate the vulnerability.

Any Webservice data source that is configured and still in use should be replaced with a custom implementation instead, before applying the above code. If this is not feasible, the vulnerability can be minimized by revoking the 'Manage Data Sources' from any non-administrator user and/or inheriting from the default Umbraco.Forms.Core.Providers.DatasourceTypes.Webservice class and overriding the ValidateSettings() method to ensure only trusted URLs can be used.

References When upgrading to a supported version, please take the Forms version specific upgrade notes into account and check the CMS upgrade documentation. Content and schema can also be migrated straight to the latest version using Deploy export/import with migrations.

Weakness type: CWE-829, CWE-94, CWE-502, CWE-915.

Product: UmbracoForms (NuGet) · Assigned by: mitre · Published: 2026-01-16

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: high (needs special conditions)
• Privileges required: low (any account)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.76% probability of exploitation activity in the next 30 days; percentile 55.

Timeline

• 2026-01-13 — GitHub-reviewed advisory GHSA-vrgw-pc9c-qrrc published (critical)
• 2026-01-16 — CVE record last updated
• 2026-01-16 — CVE record published by mitre

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-vrgw-pc9c-qrrc github.com
2. CVE.org record CVE-2025-68924 cve.org
3. NVD entry CVE-2025-68924 nvd.nist.gov

Other references from the CVE record and advisory

1. our.umbraco.com our.umbraco.com
2. nuget.org nuget.org
3. github.com github.com

Critical NuGet advisories · Today’s Security Digest