Widespread Exploitation of XWiki Vulnerability Observed

SecurityWeek reports that exploitation of the critical XWiki vulnerability, tracked as CVE-2025-24893 (CVSS 9.8), expanded from reconnaissance to botnets, cryptocurrency miners, scanners, and custom tools within two weeks of the bug being publicly exploited in the wild.

The flaw affects XWiki versions before 15.10.11, 16.4.1 and 16.5.0RC1, allowing remote, unauthenticated attackers to execute arbitrary code via the search endpoint, with PoC code available from early 2025 and in-the-wild activity beginning in October 2025.

According to VulnCheck, activity targeting vulnerable XWiki servers has since grown significantly, with multiple threat actors using the flaw in their attacks; the RondoDox botnet added an exploit to its toolset and began intensified targeting from 3 November, and from 7 November a second crypto-mining operation was observed alongside two new payload hosting servers and a new exploit server.

The report also notes attacks using an AWS IP address to establish a reverse shell via BusyBox nc, and other attempts to deploy web shells from IPs exposing QNAP and DrayTek interfaces to the internet. CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog two days after late October warnings, according to the agency, highlighting the growing threat and the need for patching.