December 2025 witnessed a dramatic 120% increase in high-impact vulnerabilities, with Recorded Future's Insikt Group® identifying 22 vulnerabilities requiring immediate remediation, up from 10 in November. The month was dominated by widespread exploitation of Meta's React Server Components flaw.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<p><strong>What security teams need to know:</strong></p>
<ul>
<li><strong>React2Shell pandemonium:</strong> CVE-2025-55182 triggered a global exploitation wave with multiple threat actors deploying diverse malware families</li>
<li><strong>China-nexus exploitation intensifies:</strong> Earth Lamia, Jackpot Panda, and UAT-9686 leveraged critical flaws for espionage operations</li>
<li><strong>Public exploits proliferate:</strong> Eleven of 22 vulnerabilities have proof-of-concept code available, accelerating exploitation timelines</li>
<li><strong>Legacy vulnerabilities resurface:</strong> CISA added 2018-2022 era flaws to its Known Exploited Vulnerabilities (KEV) catalog, highlighting persistent patch gaps</li>
</ul>
<p><strong>Bottom line:</strong> December's surge reflects both new zero-days and renewed interest in legacy vulnerabilities. React2Shell alone demonstrates how quickly modern web frameworks can become global attack vectors.</p>
<h2>Quick Reference Table</h2>
<p><em>All 22 vulnerabilities below were actively exploited in December 2025.</em></p>
<div>
<div>
<div><strong>#</strong></div>
<div><strong>Vulnerability</strong></div>
<div><strong>Risk</strong><br /><strong>Score</strong></div>
<div><strong>Affected Vendor/Product</strong></div>
<div><strong>Vulnerability Type/Component</strong></div>
<div><strong>Public PoC</strong></div>
</div>
<div>
<div>1</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBMtKwC/overview" rel="noreferrer" target="_blank">CVE-2025-55182</a></div>
<div>99</div>
<div>Meta React Server Components</div>
<div>CWE-502 (Deserialization of Untrusted Data)</div>
<div><a href="https://github.com/search?q=CVE-2025-55182&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>2</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBRk_r0/overview" rel="noreferrer" target="_blank">CVE-2025-66644</a></div>
<div>99</div>
<div>Array Networks ArrayOS AG</div>
<div>CWE-78 (OS Command Injection)</div>
<div>No</div>
</div>
<div>
<div>3</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/6U4U81/overview" rel="noreferrer" target="_blank">CVE-2025-48572</a></div>
<div>99</div>
<div>Google Android</div>
<div>CWE-306 (Missing Authentication for Critical Function)</div>
<div>No</div>
</div>
<div>
<div>4</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/6U4lfv/overview" rel="noreferrer" target="_blank">CVE-2025-48633</a></div>
<div>99</div>
<div>Google Android</div>
<div>Insufficient Information</div>
<div>No</div>
</div>
<div>
<div>5</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBaz1-z/overview" rel="noreferrer" target="_blank">CVE-2025-59718</a></div>
<div>99</div>
<div>Fortinet Multiple Products</div>
<div>CWE-347 (Improper Verification of Cryptographic Signature)</div>
<div><a href="https://github.com/search?q=CVE-2025-59718&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>6</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBa2HBm/overview" rel="noreferrer" target="_blank">CVE-2025-59719</a></div>
<div>99</div>
<div>Fortinet FortiWeb</div>
<div>CWE-347 (Improper Verification of Cryptographic Signature)</div>
<div><a href="https://github.com/moften/CVE-2025-59718-Fortinet-Poc" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>7</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBaZM-R/overview" rel="noreferrer" target="_blank">CVE-2025-62221</a></div>
<div>99</div>
<div>Microsoft Windows</div>
<div>CWE-416 (Use After Free)</div>
<div>No</div>
</div>
<div>
<div>8</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBMhTQJ/overview" rel="noreferrer" target="_blank">CVE-2025-8110</a></div>
<div>99</div>
<div>Gogs</div>
<div>CWE-22 (Path Traversal)</div>
<div><a href="https://github.com/search?q=CVE-2025-8110&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>9</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBgciBg/overview" rel="noreferrer" target="_blank">CVE-2025-14174</a></div>
<div>99</div>
<div>Google Chromium</div>
<div>CWE-787 (Out-of-bounds Write)</div>
<div><a href="https://github.com/zeroxjf/CVE-2025-14174-analysis" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>10</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBhnuhP/overview" rel="noreferrer" target="_blank">CVE-2025-14611</a></div>
<div>99</div>
<div>Gladinet CentreStack and Triofox</div>
<div>CWE-798 (Use of Hard-coded Credentials)</div>
<div><a href="https://github.com/pl4tyz/CVE-2025-14611-CentreStack-and-Triofox-full-Poc-Exploit" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>11</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBsdjtE/overview" rel="noreferrer" target="_blank">CVE-2025-59374</a></div>
<div>99</div>
<div>ASUS Live Update</div>
<div>CWE-506 (Embedded Malicious Code)</div>
<div>No</div>
</div>
<div>
<div>12</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBtm5Fw/overview" rel="noreferrer" target="_blank">CVE-2025-20393</a></div>
<div>99</div>
<div>Cisco Multiple Products</div>
<div>CWE-20 (Improper Input Validation)</div>
<div><a href="https://github.com/search?q=CVE-2025-20393&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>13</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/5R0AQ0/overview" rel="noreferrer" target="_blank">CVE-2025-43529</a></div>
<div>99</div>
<div>Apple Multiple Products</div>
<div>CWE-416 (Use After Free)</div>
<div>No</div>
</div>
<div>
<div>14</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/5RY_KG/overview" rel="noreferrer" target="_blank">CVE-2025-40602</a></div>
<div>99</div>
<div>SonicWall SMA1000 appliance</div>
<div>CWE-250 (Execution with Unnecessary Privileges)</div>
<div>No</div>
</div>
<div>
<div>15</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBw5PCQ/overview" rel="noreferrer" target="_blank">CVE-2025-14733</a></div>
<div>99</div>
<div>WatchGuard Firebox</div>
<div>CWE-787 (Out-of-bounds Write)</div>
<div>No</div>
</div>
<div>
<div>16</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BBx5LcP/overview" rel="noreferrer" target="_blank">CVE-2025-14847</a></div>
<div>99</div>
<div>MongoDB and MongoDB Server</div>
<div>CWE-130 (Improper Handling of Length Parameter Inconsistency)</div>
<div><a href="https://github.com/search?q=CVE-2025-14847&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>17</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/t9VBl0/overview" rel="noreferrer" target="_blank">CVE-2023-52163</a></div>
<div>99</div>
<div>Digiever DS-2105 Pro</div>
<div>CWE-862 (Missing Authorization)</div>
<div>No</div>
</div>
<div>
<div>18</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/Z2-Qcf/overview" rel="noreferrer" target="_blank">CVE-2018-4063</a></div>
<div>99</div>
<div>Sierra Wireless AirLink ALEOS</div>
<div>CWE-434 (Unrestricted Upload of File with Dangerous Type)</div>
<div>No</div>
</div>
<div>
<div>19</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BA5mEyi/overview" rel="noreferrer" target="_blank">CVE-2025-58360</a></div>
<div>99</div>
<div>OSGeo GeoServer</div>
<div>CWE-611 (Improper Restriction of XML External Entity Reference)</div>
<div><a href="https://github.com/search?q=CVE-2025-58360&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>20</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/7KUyzy/overview" rel="noreferrer" target="_blank">CVE-2025-6218</a></div>
<div>99</div>
<div>RARLAB WinRAR</div>
<div>CWE-22 (Path Traversal)</div>
<div><a href="https://github.com/search?q=CVE-2025-6218&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>21</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/neGcOR/overview" rel="noreferrer" target="_blank">CVE-2022-37055</a></div>
<div>99</div>
<div>D-Link Routers</div>
<div>CWE-120 (Classic Buffer Overflow)</div>
<div>No</div>
</div>
<div>
<div>22</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/hzmZuu/overview" rel="noreferrer" target="_blank">CVE-2021-26828</a></div>
<div>99</div>
<div>OpenPLC ScadaBR</div>
<div>CWE-434 (Unrestricted Upload of File with Dangerous Type)</div>
<div><a href="https://github.com/search?q=CVE-2021-26828&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
</div>
<p><em><strong>Table 1:</strong></em> <em>List of vulnerabilities that were actively exploited in December based on Recorded Future data (Source: Recorded Future)</em></p>
<h2>Key Trends in December 2025</h2>
<h3>Affected Vendors</h3>
<ul>
<li><strong>Fortinet</strong> continued vulnerability concerns with two critical authentication bypass flaws</li>
<li><strong>Google</strong> faced three vulnerabilities across Android (2) and Chromium (1) platforms</li>
<li><strong>Microsoft</strong> dealt with a Windows kernel use-after-free vulnerability</li>
<li><strong>Meta</strong> experienced the month's most impactful vulnerability with React2Shell</li>
<li>Additional affected vendors: Array Networks, Gogs, Gladinet, ASUS, Cisco, Apple, SonicWall, WatchGuard, MongoDB, Digiever, Sierra Wireless, OSGeo, RARLAB, D-Link, and OpenPLC</li>
</ul>
<h3>Most Common Weakness Types</h3>
<ul>
<li><strong>CWE-22</strong> – Path Traversal</li>
<li><strong>CWE-347</strong> – Improper Verification of Cryptographic Signature</li>
<li><strong>CWE-416</strong> – Use After Free</li>
<li><strong>CWE-434</strong> – Unrestricted Upload of File with Dangerous Type</li>
<li><strong>CWE-787</strong> – Out-of-bounds Write</li>
</ul>
<h3>Threat Actor Activity</h3>
<p><strong><a href="https://www.recordedfuture.com/blog/critical-react2shell-vulnerability" rel="noreferrer" target="_blank">React2Shell exploitation</a></strong> <strong>dominated December’s CVE activity:</strong></p>
<ul>
<li><strong>Threat actors observed to have exploited this vulnerability:</strong>
<ul>
<li><strong>China-nexus actors</strong> Earth Lamia and Jackpot Panda</li>
<li><strong>China-linked clusters</strong> UNC6600, UNC6586, UNC6588, UNC6603, and UNC6595</li>
<li>North Korea-linked and financially motivated groups</li>
</ul>
</li>
<li><strong>Observed payloads</strong> included EtherRAT, PeerBlight, CowTunnel, ZinFoq, Kaiji variants, Zndoor, RondoDox, MINOCAT, SNOWLIGHT, COMPOOD, HISONIC, ANGRYREBEL.LINUX, and Weaxor ransomware (using a Cobalt Strike stager)</li>
<li><strong>Infrastructure connections</strong> to HiddenOrbit relay infrastructure and GobRAT relay component</li>
</ul>
<p><strong>Additional activity:</strong></p>
<ul>
<li><strong>UAT-9686</strong> exploited Cisco Secure Email Gateway (<strong>CVE-2025-20393</strong>), deploying AquaShell, AquaPurge, and AquaTunnel</li>
<li><strong>Unknown actors</strong> leveraged Gogs vulnerability (<strong>CVE-2025-8110</strong>) for Supershell malware deployment</li>
</ul>
<h2>Priority Alert: Active Exploitation</h2>
<p>These vulnerabilities demand immediate attention due to confirmed widespread exploitation.</p>
<h3>CVE-2025-55182 | Meta React Server Components (React2Shell)</h3>
<p><strong>Risk Score: 99 (Very Critical)</strong> | CISA KEV: Added December 5, 2025</p>
<p><strong>Why this matters:</strong> Unauthenticated RCE affects React and Next.js, among the world's most popular web frameworks. Multiple threat actors are actively exploiting vulnerable instances with diverse malware payloads.</p>
<p><strong>Affected versions:</strong></p>
<ul>
<li>React packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (19.0.0, 19.1.0, 19.1.1, and 19.2.0)</li>
<li>Next.js: 15.x, 16.x, and Canary builds from 14.3.0-canary.77</li>
<li>Also affects: React Router, Waku, RedwoodSDK, Parcel, Vite RSC plugin</li>
</ul>
<p><strong>Immediate actions:</strong></p>
<ul>
<li>Upgrade React to 19.0.3, 19.1.4, or 19.2.3 immediately</li>
<li>Update Next.js to 16.0.7, 15.5.7, 15.4.8, 15.3.6, 15.2.6, 15.1.9, or 15.0.5</li>
<li>Monitor for unusual multipart/form-data POST requests consistent with Next.js Server Actions / RSC endpoints</li>
<li>Check logs for E{"digest" error patterns indicating exploitation attempts</li>
<li>Review server processes for unexpected Node.js child processes</li>
</ul>
<p><strong>Exposure:</strong> ~310,500 Next.js instances on Shodan (US, India, Germany, Japan, Australia)</p>
<div>
<div>
<div>
<img alt="" height="790" src="https://www.recordedfuture.com/media_1c78e7d8c6ef475aeadada64b85462a8f66332e7c.png?width=750&format=png&optimize=medium" width="1600" />
</div>
</div>
<div>
<div><em><strong>Figure 1:</strong></em> <em><a href="https://www.recordedfuture.com/products/vulnerability-intelligence" rel="noreferrer" target="_blank">Vulnerability Intelligence</a></em> <em>Card® for CVE-2025-55182 (React2Shell) in Recorded Future (Source: Recorded Future)</em></div>
</div>
</div>
<h3>CVE-2025-20393 | Cisco Secure Email Gateway</h3>
<p><strong>Risk Score: 99 (Very Critical)</strong> | Active exploitation by UAT-9686</p>
<p><strong>Why this matters:</strong> Chinese threat actors are actively compromising email security infrastructure to establish persistent access and pivot into internal networks.</p>
<p><strong>Affected products:</strong> Cisco Secure Email Gateway and Secure Email and Web Manager running AsyncOS</p>
<p><strong>Immediate actions:</strong></p>
<ul>
<li>Apply Cisco's security updates immediately</li>
<li>Monitor Spam Quarantine web interface access logs</li>
<li>Check for modifications to <code>/data/web/euq_webui/htdocs/index.py</code></li>
<li>Hunt for AquaShell, AquaPurge, and AquaTunnel indicators</li>
<li>Review outbound connections to suspicious IPs</li>
</ul>
<p><strong>Known C2 infrastructure:</strong> 172.233.67.176, 172.237.29.147, 38.54.56.95 (inactive)</p>
Article Link: December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity