CVE-2025-68153 — Juju is an open source application orchestration engine that enables any…
Image via opengraph.githubassets.com
🚨 CVE-2025-68153 Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller un
What This Means For You
- New vulnerability disclosed — verify if your stack is exposed.
- New tool or resource available — evaluate for your security workflow.
Related ATT&CK Techniques
🛡️ Detection Rules
1 rule · 6 SIEM formats1 detection rule mapped to MITRE ATT&CK. Free Sigma YAML below.
Web Application Exploitation Attempt — CVE-2025-68153
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2025-68153 | Privilege Escalation | Juju versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19. Authenticated users can modify application resources within the entire controller. |
| CVE-2025-68153 | Misconfiguration | Juju versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19. Allows authenticated users to modify application resources across the entire Juju controller. |
Source & Attribution
| Source Platform | Telegram |
| Channel | CVE Notify |
| Published | April 07, 2026 at 16:27 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
Ubiquiti Patches Three Max Severity UniFi OS Vulnerabilities
Ubiquiti has rolled out critical security updates addressing three maximum severity vulnerabilities in UniFi OS. BleepingComputer reports these flaws, tracked as CVE-2023-48092, CVE-2023-48093, and CVE-2023-48094,...
Megalodon GitHub Attack: 5,561 Repos Hit with Malicious CI/CD Workflows
The Hacker News reports a new automated campaign, dubbed Megalodon, that injected 5,718 malicious commits into 5,561 GitHub repositories within a mere six-hour window. This...
WordPress Ditty Plugin: Authorization Bypass Exposes Non-Public Content
CVE-2026-9011 — The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and...