Is CVE-2025-24893 actively exploited?

Yes. CVE-2025-24893 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2025-24893 be exploited remotely?

The attack vector of CVE-2025-24893 has not been classified yet.

What is the CVSS score of CVE-2025-24893?

CVE-2025-24893 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2025-24893

HIGHCISA KEVIN THE WILD

CVE-2025-24893

Published: October 30, 2025

EPSS:94.24%probability of exploitation in 30 daysPercentile:99.9th

Official Description

XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.

NVD Source

CISA KEV Advisory

XWiki Platform Eval Injection Vulnerability

XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.

Added to KEV: 2025-10-30Federal patch deadline: 2025-11-20

Required Action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Risk Analysis

XWiki Platform contains a critical eval injection vulnerability that allows any guest user to achieve remote code execution. The very high EPSS score of 0.94241 signals a strong likelihood of exploitation. This vulnerability is confirmed to be under active exploitation according to the CISA KEV catalog.

This vulnerability is actively exploited in the wild. Attackers can achieve remote code execution by sending a specific request to SolrSearch.

Recommended Action

Organizations should apply the latest security patches for XWiki Platform. Review and harden configurations related to SolrSearch to minimize exposure.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-24893 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2025-24893 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.