CISA Issues Advisory on XWiki Flaw Allowing Remote Code Execution

According to CISA, a critical vulnerability affecting XWiki Platform has been added to its Known Exploited Vulnerabilities catalog, describing an eval injection flaw that could let any guest user execute arbitrary remote code without authentication. The issue, CVE-2025-24893, lies in the SolrSearch component and is classified under CWE-95, with a CVSS score rated Critical.

Exploitation would allow unauthenticated attackers to inject code and gain full control of affected servers, potentially enabling data access, malware installation, or use as a platform for further network attacks. CISA has issued specific remediation guidance with a deadline of 20 November 2025, urging immediate application of vendor patches and the vendor’s mitigations. For cloud-based deployments, the agency points to Binding Operational Directive 22-01 requirements for vulnerability management.

If patches cannot be applied promptly, CISA recommends discontinuing use of XWiki Platform until remediation is completed, noting that there is no confirmed active exploitation in ransomware campaigns at the time but warning attackers may target unpatched systems.