---
title: Hackers Rapidly Exploit XWiki Vulnerability for Botnets and Crypto Mining
description: Urgent patch needed for XWiki vulnerability CVE-2025-24893 as hackers deploy botnets and crypto miners globally.
canonical_url: https://codekeeper.co/ticker/xwiki-vulnerability-cve-2025-24893-exploited
---

# Hackers Rapidly Exploit XWiki Vulnerability for Botnets and Crypto Mining

Urgent patch needed for XWiki vulnerability CVE-2025-24893 as hackers deploy botnets and crypto miners globally.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 17, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Multiple threat actors are actively exploiting CVE-2025-24893, a critical XWiki vulnerability discovered October 28, 2025, to deploy botnets and cryptocurrency miners on servers worldwide. CISA added it to their Known Exploited Vulnerabilities catalog just two days later on October 30. The RondoDox botnet incorporated the flaw by November 3, causing a sharp spike in attacks. Hackers are using the vulnerability to execute malicious code through XWiki's SolrSearch endpoint, with attacks ranging from automated scanning to sophisticated reverse shell attempts from AWS IP addresses. Organizations should immediately patch XWiki installations, monitor for unusual SolrSearch requests, and implement network segmentation to reduce exposure. **Source:** [Cyber Security News](https://cybersecuritynews.com/xwiki-vulnerability-exploited-in-the-wild/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fxwiki-vulnerability-cve-2025-24893-exploited%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Data breaches Pentagon Data Breach Exposes Personal Info of 3 Million People Sep 30, 2026](https://codekeeper.co/ticker/us-defense-data-breach-exposes-3-million-records)

[Ransomware Gang Teams Up With Supply Chain Hackers in "Industrialized" Attack Model Aug 12, 2026](https://codekeeper.co/ticker/sophos-warns-of-vect-teampcp-cyber-threat)

[Cyberattacks Trezor Users Hit by Phishing After Brevo Platform Hack Sep 14, 2026](https://codekeeper.co/ticker/trezor-customers-phishing-attack-brevo-breach)

[Cyberattacks Silver Fox-Linked Hackers Are Using Fake Software Installers to Blind Windows Defender Sep 2, 2026](https://codekeeper.co/ticker/silver-fox-fake-software-campaign)