# KEV CVEs Used by Ransomware CVEs that CISA knows are used in ransomware campaigns. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/enrichment-cisa-kev-known-ransomware-campaign-use/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs that CISA knows are used in ransomware campaigns. Example 8 of 9 in **Filters › CISA KEV Catalog** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `enrichment.cisa_kev.known_ransomware_campaign_use` · `operator` `eq` `enrichment.cisa_kev.known_ransomware_campaign_use` is `Known` when the CVE is known to be used in ransomware campaigns, otherwise `Unknown`. `eq` matches the exact value `Known`. In the response, look at `results[].enrichment.cisa_kev.known_ransomware_campaign_use`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `enrichment.cisa_kev.known_ransomware_campaign_use` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `Known` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "enrichment.cisa_kev.known_ransomware_campaign_use", "type": "eq", "value": "Known" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].configurations[].nodes[].cpe_match: first 10 items; results[].enrichment.cpe: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 362, "results": [ { "id": "CVE-2026-20131", "source_identifier": "user@cisco.com", "published": "2026-03-04T18:16:27Z", "last_modified": "2026-06-17T10:17:10Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2026-03-19", "cisa_action_due": "2026-03-22", "cisa_required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisa_vulnerability_name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced." }, { "lang": "es", "value": "Una vulnerabilidad en la interfaz de gestión basada en web del software Cisco Secure Firewall Management Center (FMC) podría permitir a un atacante remoto no autenticado ejecutar código Java arbitrario como root en un dispositivo afectado.\nEsta vulnerabilidad se debe a la deserialización insegura de un flujo de bytes Java proporcionado por el usuario. Un atacante podría explotar esta vulnerabilidad enviando un objeto Java serializado diseñado a la interfaz de gestión basada en web de un dispositivo afectado. Un exploit exitoso podría permitir al atacante ejecutar código arbitrario en el dispositivo y elevar privilegios a root.\nNota: Si la interfaz de gestión de FMC no tiene acceso público a internet, la superficie de ataque asociada con esta vulnerabilidad se reduce." } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh", "source": "user@cisco.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Technical Description" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@cisco.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@cisco.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-502" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:*", "match_criteria_id": "E0780AD6-4F38-4400-AA63-E41879F74B68", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:*", "match_criteria_id": "86BA5BA6-1F79-4C89-A3F4-A56E2B664AED", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:*", "match_criteria_id": "52C7994F-AA17-467B-919E-A49F0CC9DB47", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:*", "match_criteria_id": "9F007F6B-1EAA-468C-8159-78B020DF1E58", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:*", "match_criteria_id": "C9053FDE-A6BE-4535-AE36-A323F8B7ACA4", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:*", "match_criteria_id": "6E255975-F952-43AB-A577-B8D331DDB3AB", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*", "match_criteria_id": "DFA94312-376E-4785-888F-3C07612E1DF7", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*", "match_criteria_id": "29E73FBF-2579-4660-AFFA-7F9607004226", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*", "match_criteria_id": "87FAAFFB-0589-441B-8289-8B8A6E18F705", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*", "match_criteria_id": "73B92119-793D-4A43-A056-24DB6826E759", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.4.0.13", "affected_versions_last": "6.4.0.13" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.4.0.14", "affected_versions_last": "6.4.0.14" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.4.0.15", "affected_versions_last": "6.4.0.15" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.4.0.16", "affected_versions_last": "6.4.0.16" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.4.0.17", "affected_versions_last": "6.4.0.17" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.4.0.18", "affected_versions_last": "6.4.0.18" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.0.0", "affected_versions_last": "7.0.0" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.0.0.1", "affected_versions_last": "7.0.0.1" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.0.1", "affected_versions_last": "7.0.1" }, { "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*", "vendor": "cisco", "product": "secure_firewall_management_center", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.0.1.1", "affected_versions_last": "7.0.1.1" } ], "cwe": [ { "id": 502, "owasptop10_2021": "A08 Software and Data Integrity Failures", "name": "Deserialization of Untrusted Data", "description": "The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.", "capec_id": [ 586 ], "scope": [ "Availability", "Integrity", "Other" ], "impact": [ "DoS: Resource Consumption (CPU)", "Modify Application Data", "Unexpected State", "Varies by Context" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.33379, "percentile": 0.98303, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "Cisco", "product": "Secure Firewall Management Center (FMC)", "vulnerability_name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability", "date_added": "2026-03-19", "short_description": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.", "required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "due_date": "2026-03-22", "known_ransomware_campaign_use": "Known", "notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ; https://nvd.nist.gov/vuln/detail/CVE-2026-20131" }, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@cisco.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-15409", "source_identifier": "user@sonicwall.com", "published": "2026-07-14T20:16:56Z", "last_modified": "2026-07-16T05:16:18Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2026-07-14", "cisa_action_due": "2026-07-17", "cisa_required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "cisa_vulnerability_name": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "descriptions": [ { "lang": "en", "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location." } ], "references": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "source": "user@sonicwall.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@sonicwall.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-918" } ] } ], "configurations": [ { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*", "match_criteria_id": "7F861049-5B88-4E18-A0E7-D1E2BC7A4342", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*", "match_criteria_id": "E4A6CA48-E2D9-4F18-8FC8-B1EE7F51789C", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*", "match_criteria_id": "EBCE7761-8416-4942-B0BD-426EFC73B57C", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*", "match_criteria_id": "CE23BD37-4112-407F-9E34-04CB5A4DA996", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*", "match_criteria_id": "95E3313E-0647-40ED-9848-5AC01188A84F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*", "match_criteria_id": "75F6B9CE-73E4-42BE-9CE1-FD79255CDD0B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*", "match_criteria_id": "7B24D300-1154-49A1-A1F3-FB0CC717166A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*", "match_criteria_id": "55CD7766-9F2D-450D-A878-AA1522E8FF68", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*", "match_criteria_id": "EAF12D10-FA8F-471E-B008-68E0E29089C6", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*", "match_criteria_id": "79920402-165D-4D81-BFD2-9F679A48671A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:*", "match_criteria_id": "6842E4D7-BEDA-41FB-AEC3-CEB3692374C2", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:*", "match_criteria_id": "6AF4557F-ABAF-4795-915A-695383F64EEB", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:*", "match_criteria_id": "9459507A-A2C8-400D-8669-E8ADBDE61DE0", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*", "match_criteria_id": "E9B414C5-C376-4216-A267-ABC0930905CE", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:*", "match_criteria_id": "571C9CA1-F660-4479-9E91-B3B1714A2090", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:*", "match_criteria_id": "58706C99-B77F-4AE5-BD45-EBA65DEE2485", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:*", "match_criteria_id": "9E698DFA-1684-43E3-9964-0E207A7A2CC1", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:*", "match_criteria_id": "F2F44543-2404-4CDF-9D2F-1B851660F5D5", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:*", "match_criteria_id": "1E14F40F-4AA1-42B4-998E-AC965FBBE519", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:*", "match_criteria_id": "43197E99-0500-4971-8A66-4E70F8138289", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*", "match_criteria_id": "653B5F4D-7417-4A85-B385-46157A1540A6", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma6210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.4.3-03245", "affected_versions_last": "12.4.3-03245" }, { "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma6210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.4.3-03387", "affected_versions_last": "12.4.3-03387" }, { "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma6210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.4.3-03434", "affected_versions_last": "12.4.3-03434" }, { "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma6210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.5.0-02283", "affected_versions_last": "12.5.0-02283" }, { "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma6210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.5.0-02624", "affected_versions_last": "12.5.0-02624" }, { "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma6210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.5.0-02800", "affected_versions_last": "12.5.0-02800" }, { "criteria": "cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma6210", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma7210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.4.3-03245", "affected_versions_last": "12.4.3-03245" }, { "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma7210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.4.3-03387", "affected_versions_last": "12.4.3-03387" }, { "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*", "vendor": "sonicwall", "product": "sma7210_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "12.4.3-03434", "affected_versions_last": "12.4.3-03434" } ], "cwe": [ { "id": 918, "owasptop10_2021": "A10 Server-Side Request Forgery (SSRF)", "name": "Server-Side Request Forgery (SSRF)", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.", "capec_id": [ 664 ], "scope": [ "Access Control", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.84535, "percentile": 0.99691, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "SonicWall", "product": "SMA1000 Appliances", "vulnerability_name": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "date_added": "2026-07-14", "short_description": "SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "due_date": "2026-07-17", "known_ransomware_campaign_use": "Known", "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409" }, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2025-55182", "source_identifier": "user@fb.com", "published": "2025-12-03T16:15:56Z", "last_modified": "2026-08-04T05:16:35Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2025-12-05", "cisa_action_due": "2025-12-12", "cisa_required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisa_vulnerability_name": "Meta React Server Components Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en", "value": "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints." } ], "references": [ { "url": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components", "source": "user@fb.com", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "https://www.facebook.com/security/advisories/cve-2025-55182", "source": "user@fb.com", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/03/4", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Patch", "Third Party Advisory" ] }, { "url": "https://news.ycombinator.com/item?id=46136026", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking" ] }, { "url": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@fb.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-502" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*", "match_criteria_id": "C66E1B0F-8C3F-4D27-9F46-B6EC78D8C60B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*", "match_criteria_id": "C6C1C3E2-542D-4001-BFA9-6CF5A038971D", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*", "match_criteria_id": "A0907E1C-E2D2-44A4-AA46-CE80BCA4E015", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*", "match_criteria_id": "0030B5E1-E79E-4C48-B500-91747FE2751D", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "match_criteria_id": "FC2BCD83-CC87-4CDC-AD9B-2055912A8463", "version_start_including": "15.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.0.5" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "match_criteria_id": "C5E767D4-E46F-4CA6-A22F-4D0671B9B102", "version_start_including": "15.1.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.1.9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "match_criteria_id": "5EFB6CB7-4A4F-464A-A1D8-62B50DF0B4BA", "version_start_including": "15.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "match_criteria_id": "83AF54D7-410D-42B4-853A-8A1973636542", "version_start_including": "15.3.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.3.6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "match_criteria_id": "3D666EA7-BDAE-4E67-A331-B7403C3AA482", "version_start_including": "15.4.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.4.8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "match_criteria_id": "E666ECDA-7A29-4D3D-AC40-357F044AD595", "version_start_including": "15.5.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.5.7" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "match_criteria_id": "CF65554E-4BF0-4344-AE7F-9E09E34E084F", "version_start_including": "16.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "16.0.7" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*", "match_criteria_id": "B209A306-CE1A-448D-8653-7627302399B7", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*", "match_criteria_id": "D1DCAC23-7ED0-456B-8AE2-57689199F708", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*", "match_criteria_id": "8B35D612-AC2A-4697-934F-372E4D5EE3F4", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*", "vendor": "facebook", "product": "react", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "19.0.0", "affected_versions_last": "19.0.0" }, { "criteria": "cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*", "vendor": "facebook", "product": "react", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "19.1.0", "affected_versions_last": "19.1.0" }, { "criteria": "cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*", "vendor": "facebook", "product": "react", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "19.1.1", "affected_versions_last": "19.1.1" }, { "criteria": "cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*", "vendor": "facebook", "product": "react", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "19.2.0", "affected_versions_last": "19.2.0" }, { "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vendor": "vercel", "product": "next.js", "product_type": "a", "vulnerable": true, "version_start_including": "15.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.0.5", "affected_versions_first": "15.0.0", "affected_versions_last": "15.0.4" }, { "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vendor": "vercel", "product": "next.js", "product_type": "a", "vulnerable": true, "version_start_including": "15.1.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.1.9", "affected_versions_first": "15.1.0", "affected_versions_last": "15.1.8" }, { "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vendor": "vercel", "product": "next.js", "product_type": "a", "vulnerable": true, "version_start_including": "15.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.2.6", "affected_versions_first": "15.2.0", "affected_versions_last": "15.2.5" }, { "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vendor": "vercel", "product": "next.js", "product_type": "a", "vulnerable": true, "version_start_including": "15.3.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.3.6", "affected_versions_first": "15.3.0", "affected_versions_last": "15.3.5" }, { "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vendor": "vercel", "product": "next.js", "product_type": "a", "vulnerable": true, "version_start_including": "15.4.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.4.8", "affected_versions_first": "15.4.0", "affected_versions_last": "15.4.7" }, { "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vendor": "vercel", "product": "next.js", "product_type": "a", "vulnerable": true, "version_start_including": "15.5.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "15.5.7", "affected_versions_first": "15.5.0", "affected_versions_last": "15.5.6" } ], "cwe": [ { "id": 502, "owasptop10_2021": "A08 Software and Data Integrity Failures", "name": "Deserialization of Untrusted Data", "description": "The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.", "capec_id": [ 586 ], "scope": [ "Availability", "Integrity", "Other" ], "impact": [ "DoS: Resource Consumption (CPU)", "Modify Application Data", "Unexpected State", "Varies by Context" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.99802, "percentile": 0.99958, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "Meta", "product": "React Server Components", "vulnerability_name": "Meta React Server Components Remote Code Execution Vulnerability", "date_added": "2025-12-05", "short_description": "Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.", "required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "due_date": "2025-12-12", "known_ransomware_campaign_use": "Known", "notes": "Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182" }, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@fb.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [Ransomware CVEs Added to KEV in 2026](/reference/vulnerability/search/examples/ransomware-kev-2026/) - [KEV Product: Exchange Server](/reference/vulnerability/search/examples/enrichment-cisa-kev-product/) - [KEV Vendor: Microsoft](/reference/vulnerability/search/examples/enrichment-cisa-kev-vendor-project/) - [CVEs With a CVSS v3.0 Score](/reference/vulnerability/search/examples/enrichment-vdeep-metric-available-versions/) - [Deepinfo Score From the NVD](/reference/vulnerability/search/examples/enrichment-vdeep-metric-type/) - [Deepinfo Score From CVSS v2](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-version/)