CISA Adds Critical React2Shell Vulnerability to KEV Catalog Following Active Exploitation

A critical vulnerability affecting Meta React Server Components has been added to the Known Exploited Vulnerabilities catalog, signalling widespread active exploitation by CISA.

Tracked as CVE-2025-55182, this remote code execution vulnerability poses an immediate threat to organizations that rely on React Server Components.

The vulnerability stems from a significant flaw in how React Server Components decode payloads sent to React Server Function endpoints.

Attackers can exploit this weakness to achieve unauthenticated remote code execution. Potentially compromising affected systems without requiring authentication or user interaction.

This characteristic makes the vulnerability particularly dangerous and easier for threat actors to weaponize across diverse network environments.

CISA assigned a critical severity rating to this vulnerability, emphasizing its potential for widespread impact.

The agency added CVE-2025-55182 to its KEV catalog on December 5, 2025, establishing a mandatory remediation deadline of December 26, 2025, for federal agencies and critical infrastructure operators.

This 21-day window reflects the urgent nature of the threat and the agency’s assessment of active exploitation activity.

Organizations using Meta React Server Components must prioritize immediate remediation efforts.

CISA recommends applying the vendor-provided mitigations or following the applicable BOD 22-01 guidance for cloud services.

For organizations unable to implement patches or mitigations, discontinuing use of the affected product may be necessary to maintain a security posture.

Security researchers have not documented confirmed connections between this vulnerability and ransomware campaigns.

Though the critical nature and active exploitation status suggest heightened risk regardless.

Organizations should monitor threat intelligence feeds and security advisories for developments on this front.

This addition to CISA’s KEV catalog underscores the critical importance of vulnerability management programs and rapid patch deployment cycles.

As threat actors actively exploit CVE-2025-55182, the window for defensive action narrows considerably.

Organizations should immediately assess their infrastructure for affected React Server Components (RSC) deployments and take action before the December 26 deadline.

Security teams are urged to review their current React implementations and test compatibility with available patches in controlled environments.

Develop deployment plans to minimize operational disruption while ensuring comprehensive coverage across all affected systems.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post CISA Adds Critical React2Shell Vulnerability to KEV Catalog Following Active Exploitation appeared first on Cyber Security News.