RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025

RondoDox botnet expanded by exploiting the XWiki RCE bug CVE-2025-24893, a flaw with a CVSS score of 9.8 that remains a risk for unpatched XWiki servers, despite fixes released in February 2025. Attacks targeting CVE-2025-24893 surged after the botnet added the vulnerability to its repertoire, with the first RondoDox exploit observed on 3 November 2025.

Exploitation is linked to the botnet through its User-Agent and payload names, with servers such as 74.194.191[.]52 delivering malicious scripts; other actors followed on 7 November by fetching an obfuscated payload that deployed a coin miner. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the XWiki Platform flaw to its Known Exploited Vulnerabilities (KEV) catalogue at the end of October, according to the agency.

The XWiki vulnerability resides in its SolrSearch feature and can allow unauthenticated users to execute arbitrary code, with patches available in XWiki versions 15.10.11, 16.4.1, and 16.5.0RC1. A VulnCheck report cited in the piece notes rapid exploitation growth and that once a vulnerability lands in KEV, attackers are often days ahead in the wild.