CISA Warns of Active Exploitation in XWiki and VMware Vulnerabilities

According to The U.S. Cybersecurity and Infrastructure Security Agency (CISA), two new flaws have been added to the Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-24893 in XWiki Platform and CVE-2025-41244 in Broadcom VMware Aria Operations and VMware Tools, with evidence of active exploitation in the wild.

The XWiki flaw is a remote code execution vulnerability in the SolrSearch macro that can be triggered by unauthenticated attackers, while the VMware issue enables local privilege escalation for non-administrative users on a VM managed by Aria Operations with the SDMP enabled, potentially granting root access. Broadcom has confirmed ongoing exploitation, and the attacks have been linked to the Chinese state‑sponsored group UNC5174.

In line with CISA’s Binding Operational Directive 22-01, all Federal Civilian Executive Branch agencies must remediate both vulnerabilities by 20 November 2025. Patches for XWiki were released in June 2024, and researchers have observed in-the-wild activity resuming, including crypto-miner deployments following initial exploitation.