CVE-2025-24893
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: xWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. EPSS 100% (100th percentile).
CISA federal remediation date Nov 20 · date passed
Vulnerabilities · 231 days ago
Google found bug exploits caused 44.5% of investigated intrusions versus 27% for credential theft.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: xWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. EPSS 100% (100th percentile).
CISA federal remediation date Nov 20 · date passed
Known exploited · CISA KEV
CVSS 10 CRITICAL: a pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0… Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Dec 12 · date passed
4 sources covering this story
Most Google Cloud Attacks Start With Bug Exploitation
Thanks to AI, the new top cause of cloud compromises is vulnerability exploits that beat patching cycles.
Software vulnerabilities push credential abuse aside in cloud intrusions - Help Net Security
Cyber threats in cloud environments are shifting toward software vulnerabilities, identity compromise and insider data theft.
Cloud Attackers Now Prefer Vulnerability Exploits Over Credentials
Google Cloud report details a sharp rise in attackers exploiting software vulnerabilities, including React2Shell
Google: Cloud attacks exploit flaws more than weak credentials
Hackers are increasingly exploiting newly disclosed vulnerabilities in third-party software to gain initial access to cloud environments, with the window for attacks shrinking from weeks to just days.
Part of the PlainSec briefing for 2026-03-23