Hackers Rapidly Exploit XWiki Vulnerability for Botnets and Crypto Mining

Urgent patch needed for XWiki vulnerability CVE-2025-24893 as hackers deploy botnets and crypto miners globally.

Nov 17, 2025

ON THIS PAGE

Multiple threat actors are actively exploiting CVE-2025-24893, a critical XWiki vulnerability discovered October 28, 2025, to deploy botnets and cryptocurrency miners on servers worldwide. CISA added it to their Known Exploited Vulnerabilities catalog just two days later on October 30.

The RondoDox botnet incorporated the flaw by November 3, causing a sharp spike in attacks. Hackers are using the vulnerability to execute malicious code through XWiki's SolrSearch endpoint, with attacks ranging from automated scanning to sophisticated reverse shell attempts from AWS IP addresses.

Organizations should immediately patch XWiki installations, monitor for unusual SolrSearch requests, and implement network segmentation to reduce exposure.

Source: Cyber Security News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?