CVE-2025-55182Vulnerability
Meta React Server Components Remote Code Execution Vulnerability
Reported by 11 independent sources · first reported by Trend Micro Research · last reported
Last reported 9 days ago
Fix due 12 Dec 2025
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 17 Oct 2026
What the reports say
23 reports · the newest 20, newest first · the exact sentence from each-
AI-Powered Espionage Campaign Targets Government Linux Infrastructure“CVE-2025-55182 (React2Shell) vulnerability scanner”
-
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms“The interface groups targets under five named exploitation chains: react2shell (CVE-2025-55182), wp2shell (CVE-2026-63030 and CVE-2026-60137), xss2shell (CVE-2026-64638), joomla2shell (CVE-2026-48907), and deep.”
-
Don't Eat the ChocoPoCs: Trojanised PoCs Hit Researchers“When a critical vulnerability affects a large attack surface - such as React2Shell (CVE-2025-55182), FortiWeb (CVE-2025-64446), or Ivanti Sentry (CVE-2026-10520) - every hour counts to produce a scan module before attackers weaponise and mass-exploit the vulnerability.”
-
How Huntress Uses Managed SIEM to Detect Threats Faster“"PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182"”
-
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware“At that time, the initial access vector was exploitation of CVE-2025-55182 (React2Shell) targeting Linux servers.”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“Separately, we found Linux NOODLERAT samples that were reportedly dropped via the exploitation of CVE-2025-55182 (React2Shell).”
-
Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting“We identified a large-scale React2Shell (CVE-2025-55182) operation that scanned millions of targets and confirmed 900+ successful exploits.”
-
Untangling a Linux Incident With an OpenAI Twist (Part 2)“Upon further investigation, we found that the activity is consistent with exploitation of CVE-2025-55182 (also known”
-
JSAC2026 -Day 1-“It primarily exploited vulnerabilities in public-facing servers, including React2Shell (CVE-2025-55182).”
-
Multiple Threat Actors Rapidly Exploit React2Shell: A Case Study of Active Compromise“On December 3, 2025 (local time), a vulnerability allowing unauthenticated remote code execution in React Server Components (RSC) (CVE-2025-55182) was disclosed.”
-
React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic“Two months after CVE-2025-55182 was disclosed on December 3, 2025, exploitation activity targeting React Server Components has consolidated significantly.”
-
Introducing ÆSIR: Finding Zero-Day Vulnerabilities at the Speed of AI“As an example, it has tracked and triaged over 140 proof-of-concept exploits and multiple in-the-wild campaigns exploiting CVE-2025-55182 (React2Shell).”
-
Threat Actors Actively Targeting LLMs“Both IPs appear extensively in GreyNoise data with histories of CVE exploitation: CVE-2025-55182 (React2Shell), CVE-2023-1389, and over 200 other vulnerabilities.”
-
Tradecraft Tuesday Recap“… lines are dissolving and included an urgent call for defenders to mitigate the critical React remote code execution vulnerability (CVE-2025-55182) that has led to fast-moving exploitation across the web.”
-
There's Payloads, And Then There's pAIloads: A Look At Selected Opportunistic (And Possibly AI-"Enhanced") React2Shell Probes and Attacks“React Server Components Unsafe Deserialization CVE-2025-55182 RCE Attempt”
-
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182“PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182”
-
CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation“CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation”
-
React2Shell: Remote Code Execution Vulnerability (CVE-2025-55182)“React2Shell: Remote Code Execution Vulnerability (CVE-2025-55182)”
-
CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far“CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far”
-
Critical React Server Components Vulnerability CVE-2025-55182: What Security Teams Need to Know“Critical React Server Components Vulnerability CVE-2025-55182: What Security Teams Need to Know”
Indicators reported together
named in the same reports- 154.89.152[.]240in 2 reports
- 38.165.44[.]205in 2 reports
- hxxp://38.165.44[.]205/1in 2 reports
- 45.76.155[.]14in 2 reports
- api.qtss[.]ccin 2 reports
- vps-zap812595-1.zap-srv[.]comin 2 reports
- cs2.ip.thc[.]orgin 1 report
- denemekulubum.com[.]trin 1 report
- wiprz[.]comin 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2025-66478, CVE-2021-4034, CVE-2026-48907, CVE-2026-48908, CVE-2026-60137, CVE-2026-63030, CVE-2026-0257, CVE-2026-10520, CVE-2026-50751, CVE-2021-26855, CVE-2025-9501
Thanks — we review every report.