# Laravel Livewire Unauthenticated RCE via Synthesizer Smuggling — MuddyWater Active Exploitation (CVE-2025-54068)

> Critical unauthenticated remote code execution vulnerability in Laravel Livewire v3 (CVE-2025-54068, CVSS 9.8) exploited via synthesizer smuggling during property update hydration. Actively exploited by Iran-linked MuddyWater (MOIS) targeting government, critical infrastructure, and defense sectors. Added to CISA KEV on March 20, 2026 with April 3, 2026 remediation deadline.

- **Published:** 2026-03-21T12:00:00Z
- **Last reviewed:** 2026-03-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0265
- **ID:** TL-2026-0265
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-54068

## Description

CVE-2025-54068 is a critical code injection vulnerability in Laravel Livewire v3 that enables unauthenticated remote command execution through the framework's hydration mechanism. The vulnerability affects Livewire versions 3.0.0-beta.1 through 3.6.3, impacting an estimated 130,000+ applications and potentially millions of Laravel deployments. Livewire has been downloaded over 64 million times, and 1,754 packages depend on it, including Filament (18 million installations).

The root cause lies in HandleComponents.php, specifically in the hydrateForUpdate function. When component properties are updated via HTTP POST requests to the /livewire/update endpoint, the framework processes property updates through a hydration pipeline that synchronizes client-side state with server-side properties. The vulnerability exploits the recursive nature of this hydration process: when the raw snapshot data contains a synthesizer marker, Livewire calls the hydrate function on the new user-controlled value using that same synthesizer context, without proper validation of synthesizer types.

The attack technique, dubbed "synthesizer smuggling," works by nesting malicious synthesizers inside arrays within the updates field of Livewire requests. Since hydration is recursive, each nested array element undergoes independent validation. Attackers send a property update as an empty array, triggering automatic conversion to a synthetic tuple format. The recursive processor then handles each nested child independently, allowing the original snapshot's synthesizer metadata to apply to attacker-controlled values. This enables arbitrary class instantiation with attacker-supplied constructor parameters.

The exploit chains multiple synthesizers: CollectionSynth (clctn) allows instantiating arbitrary classes with array constructor parameters; FormObjectSynth (form) instantiates form objects and sets public properties directly; and ModelSynth (mdl) creates model instances without authentication. The proof-of-concept chains three phases: (1) function execution via GuzzleHttp\Psr7\FnStream with dynamic __toString binding, (2) RCE via Laravel\SerializableClosure\Serializers\Signed with controlled __invoke executing call_user_func_array(), chaining to Illuminate\Bus\Queueable dispatchNextJobInChain() which calls unserialize() on attacker-controlled data using a Laravel/RCE4Adapted gadget chain, and (3) clean exit via Laravel\Prompts\Terminal::exit().

Critically, the vulnerability entirely bypasses the APP_KEY checksum protection mechanism. Exploitation requires only knowledge of the target URL and component structure — no authentication, no user interaction, and no APP_KEY knowledge. Synacktiv released Livepyre, an automated exploitation tool that detects vulnerability presence and deploys payloads with or without APP_KEY knowledge.

Active exploitation has been attributed to MuddyWater (also known as Seedworm, Boggy Serpens, Static Kitten, Mercury, Mango Sandstorm), an Iranian state-sponsored group operating as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS). The campaign began in early February 2026, with escalated activity following U.S. and Israeli military strikes on Iran. MuddyWater has deployed multiple custom C2 frameworks (KeyC2, PersianC2, ArenaC2) and novel malware including the Dindoor backdoor (leveraging Deno JavaScript runtime) and Fakeset (Python backdoor). Targets span government agencies, critical infrastructure, financial institutions, airports, defense supply chains, and non-profit organizations across the United States, Israel, Jordan, Egypt, UAE, and Portugal.

CISA added CVE-2025-54068 to the Known Exploited Vulnerabilities catalog on March 20, 2026, alongside CVE-2025-31277 (Apple WebKit), CVE-2025-43510 (Apple kernel), CVE-2025-43520 (Apple kernel), and CVE-2025-32432 (Craft CMS, CVSS 10.0). Federal agencies must remediate by April 3, 2026. The EPSS score of 48.851% places this vulnerability in the 98th percentile for exploitation probability.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1547 Boot or Logon Autostart Execution
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1110 Brute Force
- T1046 Network Service Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1595 Active Scanning
- T1587 Develop Capabilities
- T1565 Data Manipulation

## Sources

- [CISA KEV - CVE-2025-54068 Added March 20, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [GitHub Security Advisory GHSA-29cq-5w36-x7w3](https://github.com/advisories/GHSA-29cq-5w36-x7w3)
- [Livewire Security Advisory — Remote Command Execution](https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3)
- [NVD - CVE-2025-54068](https://nvd.nist.gov/vuln/detail/CVE-2025-54068)
- [Synacktiv — Livewire Remote Command Execution Through Unmarshaling](https://www.synacktiv.com/en/publications/livewire-remote-command-execution-through-unmarshaling)
- [Ctrl-Alt-Intel — MuddyWater Exposed: Inside an Iranian APT Operation](https://ctrlaltintel.com/threat%20research/MuddyWater/)
- [The Hacker News — CISA Flags Apple, Craft CMS, Laravel Bugs in KEV](https://thehackernews.com/2026/03/cisa-flags-apple-craft-cms-laravel-bugs.html)
- [The Hacker News — Iran-Linked MuddyWater Hackers Target U.S. Networks With Dindoor Backdoor](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html)
- [SecurityOnline — Critical Livewire RCE Threatens Millions of Laravel Apps](https://securityonline.info/critical-livewire-rce-cve-2025-54068-threatens-millions-of-laravel-apps-patch-immediately/)
- [SecurityOnline — PoC Released for Critical Livewire RCE](https://securityonline.info/critical-flaw-in-livewire-exposes-laravel-apps-to-stealthy-rce-poc-releases/)
- [SentinelOne — CVE-2025-54068 Vulnerability Database Entry](https://www.sentinelone.com/vulnerability-database/cve-2025-54068/)
- [Wiz — CVE-2025-54068 Impact, Exploitability, and Mitigation](https://www.wiz.io/vulnerability-database/cve/cve-2025-54068)
- [SecuringLaravel — Livewire v3 RCE Security Notice](https://securinglaravel.com/security-notice-livewire-v3-rce/)
- [Help Net Security — Iran-linked APT Targets US Critical Sectors With New Backdoors](https://www.helpnetsecurity.com/2026/03/06/seedworm-muddywater-backdoors-victims/)
- [SOCRadar — Iranian APT MuddyWater Uses Dindoor Malware](https://socradar.io/blog/iran-muddywater-dindoor-malware-us-networks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0265