U.S. CISA adds XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities catalog

According to U.S. CISA, XWiki Platform and Broadcom VMware Aria Operations and VMware Tools flaws have been added to the Known Exploited Vulnerabilities catalog. The entries include CVE-2025-24893 for XWiki Platform Eval Injection Vulnerability (CVSS 9.8) and CVE-2025-41244 for Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability (CVSS 7.8).

The XWiki flaw affects unauthenticated users who can execute arbitrary code via the SolrSearch endpoint, with patches issued for versions 15.10.11, 16.4.1 and 16.5.0RC1 and an immediate upgrade advised. The second vulnerability is a local privilege escalation that can allow a non-administrative user with access to a VM running VMware Tools to escalate to root on the same VM, and Broadcom notes the CVSS base score reaching up to 7.8 in its advisory.

The publication also references that the zero-day CVE-2025-41244 has been exploited in the wild by UNC5174 since mid-October 2024, and that federal agencies must address identified flaws by 20 November 2025 under Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities.