CISA adds CVE-2025-55182 to known exploited vulnerabilities catalog

Meta's React Server Components contain a remote code execution vulnerability that CISA has added to its Known Exploited Vulnerabilities (KEV) Catalog after evidence of active exploitation.

The catalog entry is CVE-2025-55182, identified as a Meta React Server Components remote code execution vulnerability.

This category of vulnerability is a frequent attack vector for malicious cyber actors and poses risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01 established the KEV Catalog as a living list of Common Vulnerabilities and Exposures (CVE) that carry risk to the federal enterprise and requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats.

Although BOD 22-01 applies only to FCEB agencies, CISA urges all organizations to reduce their exposure by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice and states it will continue to add vulnerabilities to the catalog that meet the specified criteria.