CVE-2025-54068

Think of Livewire like a “smart page” that updates itself without reloading the whole site. This flaw lets an attacker send special input so Livewire incorrectly “loads” data and can end up running commands on your server. In real attacks, this has been used to steal credentials and compromise many apps.

This matters if your business runs a web application that uses livewire/livewire (Livewire v3) version 3.6.3 or earlier.

Because the attacker does not need a login or user action, exposure depends mainly on whether the vulnerable Livewire component(s) are mounted and configured in a way that allows the “property update hydration” path to be reachable over the network.

This is RED because exploitation is confirmed in CISA’s KEV and real-world incidents have been reported, meaning attackers are actively using this flaw. With remote command execution and no login requirement, a vulnerable, exposed installation is a direct path to full compromise. Upgrade to 3.6.4 immediately.

Confirm exposure

1. Identify the installed version of livewire/livewire used by your application.
   • If you are on Livewire v3 and your version is 3.6.3 or earlier, you should treat you as affected.
2. Review which Livewire components are mounted and how they handle property updates.
   • The findings indicate exploitation requires a component to be mounted and configured “in a specific way” for property update hydration to be reachable.
   • If you have multiple Livewire components/pages, prioritize those that accept and process externally influenced input.

Patch (primary remediation)

3. Upgrade to the vendor fixed version:
   • Upgrade livewire/livewire to 3.6.4 or later.

Timing

4. CISA KEV remediation due date: 2026-04-03.
   • Since this is actively exploited, do not wait for the next maintenance window if you can upgrade now.

If you cannot upgrade immediately (temporary mitigation)

5. Use the vendor’s security advisory guidance and, if advised, temporarily disable or restrict the affected Livewire functionality (the components/pages involved in property update hydration) until the upgrade is complete.
   • The findings state no known workarounds; in practice, mitigations are typically “reduce exposure” and follow the vendor’s recommended steps.

After upgrading

6. Monitor for signs of compromise, especially credential theft indicators and abnormal server activity from the application host.
7. If you use incident response playbooks, treat any evidence of unexpected outbound connections, new admin accounts, or unusual authentication attempts as high priority.

Severity is critical: CVSS is 9.8 (remote, no authentication required, no user interaction required) and the weakness is CWE-94. The mechanism is unsafe handling during hydration of Livewire component property updates, which can allow an unauthenticated attacker to achieve remote command execution in specific component mount/configuration scenarios under Livewire v3 (up to and including v3.6.3).

Exploitation status: this is confirmed by CISA KEV (listed 2026-03-20) and reported as exploited in the wild, including a large-scale wave of deserialization attack traffic and credential theft activity (named actor: Wong Gen Deng).

Fix: livewire/livewire is fixed in 3.6.4; no known workarounds are available per the provided findings.

What KEV means here: it indicates CISA has confidence that real-world exploitation is occurring, so defenders should prioritize mitigation immediately rather than waiting for additional signals.