CVE-2024-21650: XWiki user registration RCE via name fields

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, and very high EPSS plus an exploit-tagged reference make this an urgent pre-auth RCE.

What it is

XWiki Platform is vulnerable to remote code execution through its guest user registration feature. An attacker can inject malicious payloads into the "first name" or "last name" fields during registration, leading to arbitrary code execution. All installations with guest registration enabled are affected, and patches exist in XWiki 14.10.17, 15.5.3 and 15.8 RC1.

Impact

An unauthenticated attacker can execute arbitrary code on the XWiki server, potentially gaining full control of the host and its data.

Attack surface

The flaw is reachable over the network via the user registration form, requiring no authentication and no user interaction beyond submitting the registration request.

Exploitation

The record is not listed in CISA KEV, but EPSS is very high (0.9348, 99.8th percentile) and a reference is tagged Exploit, indicating public exploit activity is likely.

What to do

• Upgrade to XWiki 14.10.17, 15.5.3, or 15.8 RC1 or later as soon as possible.
• If immediate patching is not possible, disable guest user registration until the upgrade is applied.
• Restrict network access to the XWiki instance to trusted users or networks where feasible.
• Monitor XWiki logs and registration activity for suspicious payloads in name fields.

Detection

• Review XWiki registration logs for unusual characters or code-like strings in first name or last name fields.
• Alert on outbound network connections or process creation from the XWiki server that deviate from normal behavior.
• Search for known exploit payload patterns in HTTP requests to the registration endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.