RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025

Securityaffairs.Co •Pierluigi Paganini • November 17, 2025

RondoDox botnet exploits unpatched XWiki flaw CVE-2025-24893 to gain RCE and infect more servers, despite fixes released in February 2025. RondoDox is targeting unpatched XWiki servers via critical RCE flaw CVE-2025-24893 (CVSS score of 9.8), pulling more devices into its botnet despite patches released in Feb 2025. The XWiki Platform is a generic wiki framework […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RondoDox Botnet Expands by Exploiting Unpatched XWiki RCE Vulnerability The RondoDox botnet is exploiting the unpatched XWiki remote code execution vulnerability CVE-2025-24893, which has a CVSS score of 9.8. Despite patches released in February 2025, many servers remain vulnerable, allowing RondoDox to infect additional devices and expand its network. The attack targets unpatched XWiki servers, increasing the botnet's reach. 3 sources 70

Extracted Entities

RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Malware (1)

Platforms (1)