Microsoft rushes to contain critical React2Shell vulnerability amid global exploitation

Tuesday 16 December 2025 - 18:50

Microsoft has issued an urgent security advisory to address a severe remote code execution (RCE) vulnerability known as React2Shell, which affects React Server Components and several Next.js versions. The flaw, tracked as CVE-2025-55182, has been classified with the highest severity score of 10.0 and is already being exploited in large-scale attacks compromising both Windows and Linux systems.

Widespread exploitation across multiple actors

Within days of disclosure, cybersecurity teams detected widespread exploitation of React2Shell by state-linked and criminal groups. Multiple threat intelligence divisions confirmed that the attacks originated largely from China-based entities, including organized campaigns led by advanced threat actors. These groups rapidly exploited the vulnerability to deploy remote access tools, cryptocurrency miners, and credential-stealing malware across cloud and enterprise networks.

Analysts reported that affected systems were often used to harvest credentials from cloud environments such as Azure, Google Cloud Platform, Amazon Web Services, and Tencent Cloud. Cybercriminals have also been injecting malicious scripts into legitimate cryptocurrency websites, compromising users' wallets and tokens. Tools like TruffleHog and Gitleaks were detected scanning repositories for sensitive information, including API keys and Kubernetes credentials.

Strong mitigation urged amid active campaigns

Microsoft is urging all developers and organizations to update immediately to React versions 19.0.1, 19.1.2, or 19.2.1 and compatible Next.js versions now patched against the flaw. The company has enhanced detection capabilities within Microsoft Defender XDR and rolled out automatic protections to block active exploitation attempts. Azure Web Application Firewall users can also implement preconfigured rules to halt malicious traffic temporarily while updates are deployed.

Security teams are advised to prioritize patching internet-exposed systems, rotate compromised credentials, and verify the integrity of any impacted container or virtual machine environments. Microsoft Defender for Cloud has added scanning features to identify vulnerable assets rapidly, offering vital visibility for organizations responding to this urgent threat.