CVE-2025-68952 is a critical security vulnerability identified in Eigent version 0.0.60, a multi-agent workforce product developed by eigent-ai. The vulnerability stems from CWE-94, which involves improper control over the generation of code, commonly known as code injection. This flaw allows an unauthenticated attacker to remotely execute arbitrary code on the target system or server by triggering a specific interaction that requires only a single click, without any user authentication or additional user interaction. The vulnerability is exploitable remotely over the network (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The impact on confidentiality, integrity, and availability is high (VC:H, VI:H, VA:H), indicating that successful exploitation can lead to complete system compromise, data theft, or destruction. The vulnerability was publicly disclosed on December 27, 2025, and has been addressed in version 0.0.61 of Eigent. No known exploits have been reported in the wild yet, but the critical nature and ease of exploitation make this a significant threat. The lack of authentication and user interaction requirements means attackers can automate exploitation attempts, increasing the risk of widespread attacks. Eigent is used to coordinate multi-agent workflows, so compromise could allow attackers to manipulate or disrupt automated processes, potentially affecting business operations and sensitive data.

For European organizations, the impact of CVE-2025-68952 could be severe. Eigent’s role as a multi-agent workforce tool means that a successful attack could lead to full system compromise, allowing attackers to execute arbitrary commands, access sensitive data, disrupt automated workflows, and potentially pivot to other internal systems. This could result in data breaches, operational downtime, financial losses, and reputational damage. Organizations in sectors relying heavily on automation and multi-agent coordination, such as manufacturing, logistics, finance, and critical infrastructure, are particularly at risk. The ease of exploitation and lack of required authentication increase the likelihood of attacks, potentially leading to widespread impact if not promptly mitigated. Additionally, the ability to remotely execute code without user interaction makes this vulnerability attractive for attackers aiming to deploy ransomware, spyware, or other malicious payloads.

European organizations should immediately upgrade Eigent to version 0.0.61 or later, where the vulnerability is patched. Until patching is possible, network-level mitigations should be implemented, including restricting access to Eigent management interfaces to trusted internal networks or VPNs, and deploying web application firewalls (WAFs) with custom rules to detect and block suspicious payloads targeting code injection patterns. Continuous monitoring for unusual process executions or network activity related to Eigent servers is recommended. Employing endpoint detection and response (EDR) solutions can help identify exploitation attempts. Organizations should also review and harden configurations, disable unnecessary features, and apply the principle of least privilege to limit potential damage. Regular backups and incident response plans should be updated to prepare for potential exploitation scenarios. Finally, raising awareness among IT and security teams about this specific vulnerability will help ensure rapid detection and response.