CISA Adds Exploited XWiki, VMware Flaws to KEV Catalog

According to CISA, the Known Exploited Vulnerabilities (KEV) catalog was expanded on 31 October 2025 to include two defects affecting XWiki and VMware products. The XWiki flaw, CVE-2025-24893 (CVSS 9.8), involves improper sanitization of search parameters that can be exploited remotely without authentication to inject malicious code via crafted search requests, potentially allowing code execution with the web server’s privileges, data leakage, or disruption of survey operations.

PoC exploits have been available for about six months, and exploitation attempts were first observed in March as reconnaissance tasks, with VulnCheck warning this week that a threat actor has used the flaw to drop a cryptocurrency miner. The VMware defect, CVE-2025-41244 (CVSS 7.8), is a local privilege escalation affecting Aria Operations and VMware Tools, enabling authenticated attackers to obtain root privileges on a VM managed by Aria Operations with SDMP enabled.

Broadcom has since updated its advisory to note that exploitation in the wild is suspected, and NVISO credited for reporting the issue, with Chinese threat actors allegedly targeting the CVE for roughly a year. CISA urged federal agencies to patch both vulnerabilities by 20 November under Binding Operational Directive 22-01.