The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two (2) exploited vulnerabilities (one in Broadcom VMware Tools and VMware Aria Operations, and another in Xwiki) to its Known Exploited Vulnerabilities (KEV) catalog. The VMware flaw, tracked as CVE-2025-41244 (CVSS 7.8/10), allows local attackers with limited privileges to escalate to root access on virtual machines when VMware Tools is managed by Aria Operations with SDMP enabled. Although patched by Broadcom in September 2025, the vulnerability was reportedly exploited as a zero-day since mid-October 2024 by a Chinese state sponsored threat actor tracked by Mandiant as UNC5174, who leveraged the vulnerabilities’ ease of exploitation to gain privileged code execution. NVISO Labs discovered the flaw earlier this year during an incident response engagement. Also added to the KEV catalog is CVE-2025-24893, a critical eval injection flaw in XWiki that enables unauthenticated remote code execution (RCE) through the “/bin/get/Main/SolrSearch” endpoint, now being weaponized to deploy cryptocurrency miners. CISA has mandated all Federal Civilian Executive Branch (FCEB) agencies to apply mitigations by no later than November 20, 2025, and CTIX analysts urge all organizations to patch immediately to prevent exploitation.