CVE-2025-68924: Umbraco Forms

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.

Affected products

• Umbraco Umbraco Forms: up to and including 8.13.16

Published 2026-01-16. Last modified 2026-06-17.