CISA Adds Critical React2Shell Flaw to KEV Catalog After Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a new critical vulnerability, informally dubbed “React2Shell,” to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-55182 – Meta React Server Components Remote Code Execution Vulnerability.

The listing follows evidence of active exploitation in the wild and triggers mandatory remediation timelines for U.S. federal civilian executive branch agencies under Binding Operational Directive (BOD) 22-01.

CVE-2025-55182 affects Meta React Server Components and arises from a flaw in how React decodes payloads sent to React Server Function endpoints.

By abusing this decoding logic, an unauthenticated attacker can achieve remote code execution (RCE) on vulnerable servers, potentially leading to complete compromise of the underlying application infrastructure.

Because the attack does not require valid credentials, Internet-exposed deployments are at particular risk.

React2Shell in KEV: Details and Deadlines

CISA’s KEV entry underscores the urgency around this bug, formally recording its addition date and a hard remediation deadline for federal agencies.

While the vulnerability has already been observed in active exploitation, its use in ransomware campaigns is not yet confirmed.

Field	Details
CVE ID	CVE-2025-55182
Vulnerability Name	Meta React Server Components Remote Code Execution Vulnerability
Component / Technology	Meta React Server Components – React Server Function endpoints
Vulnerability Type	Remote Code Execution (RCE) via flawed payload decoding
Authentication Required	No – can be exploited by unauthenticated attackers
Exploitation Status	Actively exploited in the wild (triggered CISA KEV inclusion)
Known Ransomware Use	Unknown
CISA KEV Date Added	2025-12-05
Federal Due Date (BOD 22-01)	2025-12-26
Recommended Action	Apply vendor mitigations, follow BOD 22-01 cloud guidance, or discontinue use if mitigations are unavailable

The relatively short window between Date Added (December 5, 2025) and Due Date (December 26, 2025) reflects CISA’s risk assessment.

Agencies are required to either patch, apply vendor-specified mitigations, or remove affected services from operation by the deadline.

CISA directs federal agencies to apply mitigations per vendor instructions, including updating to fixed versions of React Server Components or applying any interim configuration changes that harden React Server Function endpoints.

For cloud‑hosted environments, agencies must also align with BOD 22-01 guidance, ensuring that both managed and unmanaged cloud assets are included in their remediation plans.

Enterprises outside the federal space are strongly advised to mirror this urgency.

Development and operations teams should:

1. Identify all applications using Meta React Server Components, especially those exposing React Server Function endpoints to the internet.
2. Prioritize patching or upgrading in production and staging environments, treating these systems as high‑risk RCE exposure points.
3. Increase monitoring around affected services for anomalous payloads, suspicious process execution, or unexpected outbound connections that could indicate successful exploitation attempts.

While current intelligence does not yet confirm use of CVE-2025-55182 in ransomware campaigns, the RCE nature of React2Shell makes it an attractive target for initial access brokers and ransomware operators.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates

The post CISA Adds Critical React2Shell Flaw to KEV Catalog After Active Exploitation appeared first on Cyber Security News.