Report · CIRCL OSINT FeedAbout CVE-2025-55182Published 19 Feb 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-02-19

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Authoritative record:CVE-2025-55182· Critical 10.0

Exploited in the wild · used in ransomware campaigns · KEV due 12 Dec 2025 · public exploit available (Metasploit, Exploit-DB) · 99% EPSS · no patch yet : apply the vendor's fix or mitigations to tlp clear now.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score

10.0Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 12 Dec 2025 US federal agencies must patch by this date; a sensible deadline for everyone else.
Ransomware: Used in ransomware campaigns
EPSS: 99.8% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Not yet available

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 3 Dec 2025
Detectable: evidence found.
nuclei template: React Server Components - Remote Code Execution
Weaponised: evidence found.
1 Metasploit module · 1 Exploit-DB entry, 127 days after disclosure
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 2 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by Meta Platforms, Inc.
8 Aug 202518:21 UTC, 117 days before disclosure
CVE published
on cve.org
3 Dec 202515:40 UTC, t = 0
In Threat Radar
record ingested
3 Dec 202515:54 UTC, 14 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
5 Dec 2025, 2 days after disclosure
KEV remediation due
US federal deadline
12 Dec 2025, 9 days after disclosure
First Exploit-DB entry (opens in a new tab)
React Server 19.2.0 - Remote Code Execution
9 Apr 2026, 127 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected software

Product	Affected	Fixed in
Metareact-server-dom-webpack	Affected >=19.0.0 <=19.0.0 >=19.1.0 <=19.1.1 >=19.2.0 <=19.2.0	Fixed in–
Metareact-server-dom-turbopack	Affected >=19.0.0 <=19.0.0 >=19.1.0 <=19.1.1 >=19.2.0 <=19.2.0	Fixed in–
Metareact-server-dom-parcel	Affected >=19.0.0 <=19.0.0 >=19.1.0 <=19.1.1 >=19.2.0 <=19.2.0	Fixed in–
npmreact-server-dom-parcel`pkg:npm/react-server-dom-parcel`Other threats	Affected =19.0.0 =19.1.0 =19.1.1 =19.2.0	Fixed in–
npmreact-server-dom-turbopack`pkg:npm/react-server-dom-turbopack`Other threats	Affected =19.0.0 =19.1.0 =19.1.1 =19.2.0	Fixed in–
npmreact-server-dom-webpack`pkg:npm/react-server-dom-webpack`Other threats	Affected =19.0.0 =19.1.0 =19.1.1 =19.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

KRVTZ-NET IDS alerts from February 19, 2026, report reconnaissance activity targeting web applications using React Server Components and vulnerable JavaScript code. The alerts focus on attempts to exploit CVE-2025-55182, known as React2Shell, which allows unsafe property access, and JavaScript prototype pollution attacks via the __proto__ property in HTTP request bodies. These activities are preliminary probes without confirmed active exploitation or available patches. The vulnerabilities could enable remote code execution, privilege escalation, data manipulation, or denial of service if exploited. Multiple suspicious IPs suggest coordinated scanning, with European organizations using these technologies at particular risk. The threat is currently assessed as low severity but carries significant risk if unmitigated. Early detection, input validation, and network monitoring are recommended to reduce potential impact.

Impact

If exploited, CVE-2025-55182 and related prototype pollution vulnerabilities could allow attackers to execute remote code, escalate privileges, manipulate data, or cause denial of service in affected web applications. Although no active exploitation is confirmed, the presence of public exploit code and reconnaissance activity indicates a credible risk. The vulnerabilities affect web applications using React Server Components and vulnerable JavaScript code, potentially impacting organizations with such infrastructure, especially in Europe.

Mitigation

Organizations should implement early detection mechanisms such as IDS/IPS monitoring and network traffic analysis to identify reconnaissance attempts. Input validation and sanitization of HTTP request bodies, particularly for properties like __proto__, are critical to prevent prototype pollution attacks. Since this is not a cloud service, remediation depends on the affected organizations applying mitigations. Monitoring for suspicious IP addresses and blocking known malicious sources can reduce exposure. Follow vendor advisories for updates on patch availability.

Summary

The KRVTZ-NET IDS alerts indicate reconnaissance attempts targeting web applications that use React Server Components and vulnerable JavaScript code. Specifically, attackers are probing for CVE-2025-55182 (React2Shell), which permits unsafe property access, and prototype pollution vulnerabilities via the __proto__ property in HTTP request bodies. These reconnaissance activities are preliminary and do not confirm active exploitation. Public exploit code exists in Metasploit and Exploit-DB, and the vulnerability is listed in the CISA KEV catalog. No patches are currently available, and the affected product is not a cloud service. The reconnaissance involves multiple suspicious IP addresses, suggesting coordinated scanning efforts. The vulnerabilities could lead to severe impacts such as remote code execution and privilege escalation if exploited.

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

Indicators of compromise

IP addresses 6

15.207.110.38ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)
210.193.124.54ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)
135.233.67.152ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body
40.114.54.152ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)
217.154.251.221ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body
168.231.107.113ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Oct 2026, 21:14 UTC

Public exploits and detection1 Metasploit module, 1 Exploit-DB entry, a Nuclei detection template

Indicators of compromise

IP addresses 6

Community reviews

Related threats