CVE-2025-68924: 
C# vulnerability analysis and mitigation

CVE-2025-68924 is a Remote Code Execution (RCE) vulnerability in Umbraco Forms, titled "Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation." It affects all Umbraco Forms versions running on .NET Framework up to and including version 8 (≤ 8.13.16 on NuGet). The vulnerability was disclosed on January 13, 2026, via a GitHub Security Advisory, and published to the NVD on January 16, 2026. The GitHub Advisory Database assigns a CVSS v3.1 score of 9.9 (Critical) with scope change, while Feedly's estimate reflects 7.5 (High) without scope change (Github Advisory, Umbraco Advisory). The vulnerability was discovered and reported by Piotr Bazydlo (@chudyPB) of watchTowr (Github Advisory).

The root cause lies in how Umbraco Forms dynamically generates SOAP clients by fetching and compiling WSDL documents from a user-configured URL in the Webservice data source — a classic CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) pattern, also involving CWE-94 (Code Injection), CWE-502 (Deserialization of Untrusted Data), and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) (Github Advisory). An authenticated attacker with low privileges and the 'Manage Data Sources' permission can configure a malicious URL pointing to an attacker-controlled WSDL endpoint; when the application fetches and compiles this WSDL, it executes attacker-supplied code on the server. The attack requires network access and low-privilege authentication but no user interaction, and the scope change in the CVSS vector indicates that the impact can extend beyond the vulnerable component itself (Github Advisory, Umbraco Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary code on the server hosting Umbraco Forms, resulting in full compromise of confidentiality, integrity, and availability. The scope change in the CVSS vector indicates that the impact can extend beyond the Umbraco Forms application itself to other components on the same host or network, enabling potential lateral movement. Sensitive data stored in the CMS, databases, or connected systems may be exfiltrated, and the attacker could establish persistent access or disrupt service availability (Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.121% (31st percentile), indicating a relatively low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authenticated access and the ability to configure Webservice data sources in the Umbraco Backoffice, which limits the attacker pool but does not eliminate risk in environments with multiple backend users.

1. Reconnaissance: Identify Umbraco CMS installations running Umbraco Forms version 8.x or earlier on .NET Framework, using web fingerprinting tools or by inspecting HTTP response headers and CMS-specific paths (e.g., /umbraco/).
2. Obtain low-privilege credentials: Acquire credentials for a Backoffice user account with the 'Manage Data Sources' permission, either through phishing, credential stuffing, or insider access.
3. Set up a malicious WSDL server: Host a crafted WSDL document on an attacker-controlled server. The WSDL should be designed to trigger code injection or deserialization of malicious payloads when compiled by the .NET WSDL processing engine.
4. Configure the malicious Webservice data source: Log into the Umbraco Backoffice, navigate to Forms data source configuration, and set the Webservice data source URL to point to the attacker-controlled WSDL endpoint.
5. Trigger WSDL compilation: Cause the application to fetch and compile the WSDL — this may occur automatically upon saving the configuration or when a form using the data source is rendered/submitted.
6. Achieve Remote Code Execution: The .NET runtime compiles and executes the malicious WSDL-derived code, granting the attacker arbitrary code execution in the context of the web application process (Github Advisory, Umbraco Advisory).

• Network: Outbound HTTP/HTTPS requests from the Umbraco web server to unexpected or external WSDL endpoints (URLs ending in ?wsdl or .wsdl); unusual outbound connections from the IIS/ASP.NET worker process to attacker-controlled infrastructure.
• Logs: Umbraco Backoffice audit logs showing changes to Webservice data source configuration, especially URLs pointing to external or unfamiliar hosts; IIS access logs showing requests to form endpoints shortly after data source reconfiguration.
• File System: Unexpected temporary .cs or compiled .dll files in the ASP.NET temporary files directory (%SystemRoot%\Microsoft.NET\Framework\...\Temporary ASP.NET Files\) generated from WSDL compilation; new or modified files in the web application directory.
• Process: Unusual child processes spawned by the IIS worker process (w3wp.exe), such as cmd.exe, powershell.exe, or network utilities; unexpected network connections initiated by w3wp.exe.

No patches will be released for affected versions (≤ 8.13.16) because they are all End-of-Life (EOL). The recommended remediation is to upgrade to a currently supported version of Umbraco Forms (v13, v16, or v17) (Github Advisory). If upgrading is not immediately feasible, the Webservice data source type can be completely disabled by registering a composer that excludes it from the application (see the advisory for the code snippet). Additionally, the 'Manage Data Sources' permission should be revoked from all non-administrator Backoffice users, and the ValidateSettings() method can be overridden to restrict URLs to a trusted allowlist (Umbraco Advisory).

The vulnerability was credited to Piotr Bazydlo (@chudyPB) of watchTowr, a well-regarded security research firm known for discovering high-severity vulnerabilities in enterprise software (Github Advisory). Social media activity was noted on Mastodon/infosec.exchange via TheHackerWire shortly after disclosure. A technical write-up was published at infinitsec.net covering the SOAP hijacking RCE angle of the vulnerability. The Loginsoft threat intelligence blog also referenced the CVE in a weekly active exploitation and fake exploits roundup.