This critical remote code execution vulnerability in XWiki Platform is currently being actively exploited in the wild and requires immediate remediation.

This is an Eval Injection vulnerability (CWE-95) residing in the SolrSearch component. The flaw allows an unauthenticated attacker to inject and execute arbitrary code by sending a crafted request to the SolrSearch endpoint, which directly impacts the confidentiality, integrity, and availability of the entire XWiki installation.

The vulnerability carries a critical CVSS score of 9.5, reflecting the high potential for total system compromise. Successful exploitation grants an attacker full control over the affected XWiki instance, which could lead to unauthorized data exfiltration, persistent malware installation, and complete service disruption. Given that this vulnerability is being actively exploited in the wild, the business risk of inaction is extremely high.

Immediate Action: Upgrade to XWiki version 15.10.11, 16.4.1, or 16.5.0RC1 immediately. If an immediate upgrade is not possible, apply the vendor-recommended manual edit to the Main.SolrSearchMacros file to sanitize the response content type.

Proactive Monitoring: Monitor server logs for suspicious requests directed at the SolrSearch endpoint, specifically looking for URL parameters containing code-like structures such as groovy scripts or async macros.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming requests containing malicious patterns targeting the SolrSearch URL, such as the injection strings identified in the technical research.

Public Exploit Available: Yes, a Metasploit module and ExploitDB entries exist, alongside numerous public proof-of-concept repositories on GitHub.

Due to the confirmed active exploitation and the critical nature of this remote code execution vulnerability, immediate action is required. Organizations running affected versions of XWiki Platform must prioritize patching or applying the documented mitigation steps. Failure to address this vulnerability exposes the entire environment to full system compromise.