Blogs

Blog

The Shift to Threat-Informed Prioritization: Operationalizing CISA BOD 26-04

In this post, we examine how CISA BOD 26-04 shifts the industry away from flat CVSS scoring and details how Flashpoint bridges the critical data gaps left by public vulnerability repositories.

With the recent issuance of Binding Operational Directive (BOD) 26-04, CISA has officially shifted federal policy away from static severity scores and flat patching timelines  toward threat-informed prioritization. The move reflects a reality security teams have grappled with for years: not all critical vulnerabilities post the same risk, and not all active vulnerabilities receive the highest CVSS scores. 

Traditional vulnerability management programs have often relied on severity-based patching models that force resource-constrained teams to focus on large volumes of high-scoring vulnerabilities. Yet research consistently shows that threat actors routinely exploit a broader range of weaknesses, including lower-scoring vulnerabilities on internet-facing assets, to gain initial access and move laterally through victim environments. 

While BOD 24-04 represents a significant step forward, there are still hidden challenges organizations will face as they adopt a risk-based approach. The operational reality is that executing a truly risk-based matrix validates what Flashpoint has maintained for years: effective vulnerability prioritization requires deep, contextual threat data. Unfortunately, the needed real-world metadata for this kind of context are simply not supported by public sources of vulnerability intelligence.

Understanding BOD 26-04

BOD 26-04 evaluates the urgency of a vulnerability by cross-referencing a security flaw against four distinct operational variables:

1. Asset Exposure: Is the asset publicly accessible via the internet?
2. Known Exploited Status (KEV): Is there verifiable evidence of active exploitation in the wild?
3. Exploit Automation: Can a threat actor completely automate the weaponization and delivery of the exploit?
4. Technical Impact: Does a successful exploit result in partial disruption or total compromise of the target system?

By analyzing these variables in tandem, organizations can tier their response and execute clear, defensible SLA metrics.

Risk Priority	Real-World Matrix Conditions	Required SLA & Operational Action
P1: Immediate Risk	In KEV + Publicly Exposed + Automatable + Total Impact	3 Days (Includes Mandatory Forensic Triage)
P2: Urgent Risk	In KEV + Publicly Exposed + (Either Non-Automatable OR Partial Impact)	7 Days
P3: Elevated Risk	In KEV + Internal / Non-Publicly Exposed Asset	14 Days
P4: Standard Risk	Not in KEV + Publicly Exposed + Automatable + Total Impact	30 Days
Deferred Risk	Not in KEV + Internal Asset OR Lower Technical Impact	Next Scheduled System Upgrade / Maintenance

According to CISA, the pilot testing of this model has shown that fewer than 1% of an organization’s typical vulnerability backlog requires urgent, immediate remediation, while over 60% can be safely deferred to standard system maintenance cycles. However, implementing this framework successfully requires access to granular, real-world data points that public sources of vulnerability intelligence simply do not support. 

“Speaking with security teams in the wake of this directive, it is clear that BOD 26-04 is a major paradigm shift. While the ability to safely defer more than half of your patch backlog is an invaluable efficiency gain for modern organizations, executing that strategy effectively requires ground-truth intelligence on exploit automation and adversary intent that public registries simply cannot deliver.”

Josh Lefkowitz, CEO and Co-founder at Flashpoint

The Data Challenge

To operationalize this model successfully, organizations will require a high-fidelity intelligence pipeline that combines comprehensive threat and vulnerability intelligence into clear, context-rich insights that support prioritization and decision making. You cannot confidently defer remediation without verifiable intelligence that proves the vulnerability lacks active exploit history or automation maturity.

Unfortunately, relying on public data feeds like the CVE database or the National Vulnerability Database (NVD) to fuel this matrix creates an immediate operational bottleneck. Public repositories have historically struggled under severe analysis backlogs, leading to processing delays and missing Common Platform Enumeration (CPE) data. Furthermore, public feeds are inherently reactive; they do not monitor illicit communities where exploit code is developed, nor do they track the real-time weaponization metrics needed to meet BOD 26-04’s tight 3-day or 7-day compliance window.

How Flashpoint Solves the Prioritization Gap

Flashpoint Vulnerability Intelligence bridges the gap between public data limitations and the requirements of real-world exposure management. Independently researched and enriched, Flashpoint provides the precise contextual signals required by the CISA BOD 26-04 matrix:

• Coverage across CVE and non-CVE vulnerabilities
• Continuous tracking of exploitation activity and adversary usage
• Context on exploit maturity and remediation
• Consistent enrichment that can be integrated into operational workflows
• Over 7,000 known exploited vulnerabilities (KEV)

By integrating Flashpoint’s continuous intelligence into operational workflows, security teams can automatically validate exposure, assess automation potential, and confidently claim the operational relief that risk-based prioritization promises.

“We are convinced by Flashpoint’s superior vulnerability coverage, timeliness in the updates, and long-term monitoring of exploits. We also really appreciate Flashpoint’s proprietary CVSS rating and classifications based on expert knowledge of the standard and practical use in the industry. Having all this curated information at your fingertips is a game changer.”

Vulnerability Manager, Telecommunications

Prioritize Vulnerability Risk Using Flashpoint

CISA’s BOD 26-04 represents a critical shift away from severity-based patching and toward defensive efficiency. However, the effectiveness of this model is entirely dependent on the fidelity of your threat data.

Without best-in-class comprehensive vulnerability intelligence, security teams will be forced back into reactive patching cycles. Request a demo to learn more how Flashpoint helps security teams move beyond the constraints of static scoring and align their vulnerability management workflows with actual risk.

See Flashpoint in Action

Blogs

Blog

National Vulnerability Database (NVD) Shifts to Selective Enrichment as CVE Volume Surges

In this post, we examine what NVD’s shift to selective enrichment means for vulnerability workflows and how security teams can maintain visibility and prioritization at scale.

The National Vulnerability Database (NVD) is changing how it processes and enriches vulnerability data in response to sustained growth in CVE submissions.

Under a new model announced by the National Institute of Standards and Technology, NVD will no longer enrich every CVE. Instead, enrichment efforts will focus on a defined subset, including vulnerabilities in the CISA KEV catalog, software used by the federal government, and software designated as critical.

All other CVEs will remain in the database without additional context unless specifically requested.

Rising disclosure volumes are placing pressure on public vulnerability infrastructure, and it has direct implications for how security teams consume and act on vulnerability data.

What Changed in NVD’s Operating Model

For years, NVD aimed to provide consistent enrichment across all CVEs, including severity scoring, affected product data, and supporting context for prioritization.

That approach has not been sustainable since late 2023.

In 2025, Flashpoint tracked 44,509 disclosed vulnerabilities, 14,593 of which had publicly available exploits (and 1,944 more with proof-of-concepts). 

CVE submissions increased by 263% between 2020 and 2025, with 2026 already tracking higher year-over-year. Even with increased throughput, NVD has not been able to keep pace.

Under the updated model:

• CVEs meeting prioritization criteria will be enriched on an accelerated timeline
• CVEs outside those criteria will be labeled and left without enrichment
• Re-analysis of modified CVEs will occur selectively
• Separate NVD severity scoring will no longer be applied by default

This introduces a significant structural change in how vulnerability data is published and maintained.

The Impact on Vulnerability Workflows

Many security programs rely on NVD enrichment to operationalize CVE data. That enrichment provides the context needed to evaluate risk and determine remediation priorities.

With enrichment applied selectively, teams will encounter a growing number of CVEs that include:

• Limited or no severity scoring
• Incomplete product and version data
• Minimal context on exploitability or impact
• No CPE strings that allow for programmatic consumption of data

At the same time, disclosure volume continues to rise, and exploitation timelines remain compressed. This creates a gap between what is disclosed and what can be acted on efficiently.

Security teams will need to account for:

• Larger backlogs of CVEs without actionable context
• Increased manual effort to evaluate relevance and risk
• Greater variability in data quality across sources

These changes affect vulnerability management, threat intelligence, and security operations workflows simultaneously.

Prioritization Criteria Will Not Capture the Full Risk Landscape

NVD’s updated model focuses enrichment on a defined set of criteria, including known exploited vulnerabilities and software relevant to federal systems.

These categories represent important segments of risk, but they do not encompass the full set of vulnerabilities that organizations encounter in practice.

Modern environments include:

• Open-source dependencies
• SaaS platforms and APIs
• Cloud infrastructure and services
• Third-party and partner integrations

Many vulnerabilities affecting these environments fall outside formal prioritization frameworks or lack immediate classification within public datasets. As a result, security teams will continue to face exposure from vulnerabilities that are:

• Actively exploited but not yet included in prioritized lists
• Missing complete metadata or enrichment
• Relevant to their environment but not captured by federal-centric criteria

Vulnerability Intelligence Requires Broader Coverage and Deeper Context

As public enrichment becomes more selective, organizations will rely more heavily on alternative sources to maintain visibility and context.

Effective vulnerability intelligence requires:

• Coverage across CVE and non-CVE vulnerabilities
• Continuous tracking of exploitation activity and adversary usage
• Context on exploit maturity, and remediation
• Consistent enrichment that can be integrated into operational workflows

This level of detail supports faster and more accurate decision-making in environments where both volume and speed are increasing.

Flashpoint’s vulnerability intelligence model is built to address these requirements, with a dataset that includes over 7,000 known exploited vulnerabilities and ongoing analyst-driven enrichment across global sources.

What Security Teams Should Do Next

This shift in NVD operations does not change the need to track CVEs. It changes how that data can be used. Security teams should evaluate how their current workflows depend on:

• NVD enrichment for prioritization
• CVSS scoring as a primary decision input
• Completeness of public vulnerability data

From there, teams can take steps to strengthen resilience:

• Incorporate sources of vulnerability intelligence that cover CVE and more
• Align prioritization to exploitation activity and environmental relevance
• Validate coverage across software, cloud, and third-party dependencies
• Ensure that enrichment gaps do not delay remediation decisions

A Structural Shift in Vulnerability Data

For many teams, NVD has been a default source of vulnerability context. This change makes clear that its role is narrowing at a time when disclosure volume and prioritization demands are increasing.

At the same time, the role of vulnerability intelligence is expanding.

Security teams need access to data that supports prioritization, not just identification. They need consistent enrichment, faster turnaround, broader coverage, and context tied to real-world activity. As disclosure volumes continue to grow, those requirements become more central to how organizations manage risk.

Flashpoint’s Vulnerability Intelligence provides this level of coverage and context, with analyst-driven enrichment, global visibility across CVE and non-CVE vulnerabilities, and a dataset that includes over 7,000 known exploited vulnerabilities.

Request a demo to see how Flashpoint helps security teams prioritize and act on vulnerability risk with greater precision and confidence.

Begin your free trial today.

Blogs

Blog

Flashpoint Surpasses Cataloging 7,000 Known Exploited Vulnerabilities as Disclosure Volume Accelerates

In this post we explore Flashpoint’s latest milestone of surpassing cataloging 7,000 known exploited vulnerabilities and what this means for security teams.

Flashpoint Vulnerability Intelligence has surpassed cataloging 7,000 known exploited vulnerabilities, surpassing another major milestone as vulnerability disclosures accelerate across the global attack surface.

In 2025, Flashpoint tracked 44,509 disclosed vulnerabilities, a pace that continues to accelerate into 2026. Of those, 14,593 had publicly available exploits (1,944 more with proof-of-concepts), giving threat actors immediate pathways to weaponization.

This pace is shaping how exploitation unfolds, with high-impact vulnerabilities being operationalized within hours or days, particularly when they affect widely deployed technologies or core infrastructure.

Security teams are operating within this compressed environment every day. They are reviewing more findings across open-source software, commercial applications, cloud environments, and third-party dependencies, while working within tighter timelines to assess impact and take action.

Flashpoint’s latest milestone of surpassing 7,000 known exploited vulnerabilities (KEVs) cataloged reflects that reality. It highlights how vulnerability management programs are evolving toward prioritization as a core capability, with a focus on vulnerabilities tied to active exploitation and real-world risk.

What The 7,000+ KEV Milestone Means for You

Security teams are operating in a high-volume environment. Vulnerabilities are disclosed continuously across open-source software, commercial applications, cloud environments, and third-party dependencies. At the same time, advancements in automation and code analysis are increasing the rate at which new findings are surfaced.

Each of these findings enters an already crowded workflow. Teams are expected to determine relevance, urgency, and impact quickly, often with limited context. This is where risk-based decision making becomes essential.

Flashpoint tracks hundreds of thousands of vulnerabilities across thousands of sources. Within that dataset, a much smaller percentage shows confirmed exploitation activity. That concentration of risk informs how effective programs allocate time and resources.

Crossing the 7,000+ KEV milestone goes beyond scale to provide greater precision, deeper context, and stronger confidence in how teams prioritize and act on the most critical vulnerabilities.

• Validated threats: Each KEV entry reflects observed exploitation in the wild by threat actors, including APT groups, cybercriminal operations, ransomware presence, and automated botnets.
• Exploit-aware prioritization: In reality, only a small percentage of tracked vulnerabilities drive real-world incidents. FP KEV provides visibility into that subset so teams can focus remediation efforts where they have immediate impact.
• Human-curated intelligence: Every entry is reviewed, validated, and enriched by analysts, with context on exploit maturity, adversary usage, and remediation pathways when available.

This level of clarity allows teams to move faster without sacrificing accuracy. It supports vulnerability management programs that are built around real-world attacker behavior and aligned to current risk.

How Public Vulnerability Data Fits Into the Picture

Public vulnerability catalogs remain useful reference points for tracking disclosures and confirmed exploitation. The CISA Known Exploited Vulnerabilities catalog, for example, gives security teams a curated view into a limited set of vulnerabilities that have been exploited in the wild that impact U.S. government stakeholders.

For many organizations, though, that level of visibility is not enough.

Public catalogs capture only part of the picture. They tend to reflect a narrower slice of exploitation activity, with less detail on how vulnerabilities are being used, which actors are leveraging them, and what defenders should do next. They also rely heavily on CVE-based tracking, leaving gaps around non-CVE exposures and other vulnerabilities that still carry operational risk.

Flashpoint’s FP KEV and Vulnerability Intelligence provide a broader and more actionable view. The advantage is visible in both scale and depth. Of the 7,000 known exploited vulnerabilities in FP KEV, over 800 are missing from CVE. That expanded coverage is paired with the context security teams need to prioritize effectively, including exploit maturity, adversary mapping, affected product detail, and remediation guidance.

Dimension	Public KEV Catalogs	Flashpoint FP KEV
Scope	Varies by provider, with coverage dependent on available sources and methodology	Global, cross-industry coverage
Coverage	CVE-based tracking	CVE and non-CVE vulnerabilities
Context	Limited enrichment	Exploit maturity, adversary mapping, remediation
Update Model	Periodic updates	Continuously updated with analyst input

This is what separates a reference list from an operational dataset. Teams need vulnerability intelligence that supports triage, remediation, reporting, and broader risk reduction efforts. Wider visibility and deeper context make that possible.

The Critical Role of Human-Curated Intelligence

Vulnerability data originates from a wide range of sources with varying levels of completeness and accuracy.

Flashpoint’s intelligence model includes analyst validation to ensure consistency and depth across the dataset.

This process includes:

• Reviewing disclosures across public and private sources
• Validating exploit availability and usage
• Enriching entries with technical and operational context

Analyst input supports:

• Accurate classification of vulnerabilities
• Clear understanding of exploitation pathways
• Timely updates as activity evolves

Supporting Decision-Making Across Teams

Vulnerability intelligence feeds multiple functions across an organization. Teams use this data to align technical actions with current threat activity.

Common use cases include:

• Vulnerability management: Align patching priorities with active exploitation trends.
• Threat intelligence: Map vulnerabilities to threat actor campaigns and observed behaviors.
• Security operations: Tune detection based on known exploit techniques.
• Executive reporting: Communicate risk posture using data tied to real-world activity.

Each of these functions relies on consistent, enriched intelligence to maintain alignment.

Proactively Address Vulnerability Risk

Vulnerability discovery continues to expand across software ecosystems, infrastructure, and identity layers.

Security teams require a clear understanding of which issues are relevant to their environment at any given time.

Flashpoint provides primary source intelligence that supports this need through:

• Continuous monitoring of vulnerability disclosures and exploitation
• Analyst-driven validation and enrichment
• Integration-ready data for operational workflows

This approach enables teams to maintain focus, allocate resources effectively, and respond to risk based on current threat activity. Request a demo and learn more today.

Begin your free trial today.

Blogs

Blog

Navigating 2026’s Converged Threats: Insights from Flashpoint’s Global Threat Intelligence Report

In this post, we preview the critical findings of the 2026 Global Threat Intelligence Report, highlighting how the collapse of traditional security silos and the rise of autonomous, machine-speed attacks are forcing a total reimagining of modern defense.

The cybersecurity landscape has reached a point of total convergence, where the silos that once separated malware, identity, and infrastructure have collapsed into a single, high-velocity threat engine. Simultaneously, the threat landscape is shifting from human-led attacks to machine-speed operations as a result of agentic AI, which acts as a force multiplier for the modern adversary.

Flashpoint’s 2026 Global Threat Intelligence Report

Flashpoint’s 2026 Global Threat Intelligence Report (GTIR) was developed to anchor security leaders — from threat intelligence and vulnerability management teams to physical security professionals and the CISO’s office — with the data required to navigate this year’s greatest threats, rife with infostealers, vulnerabilities, ransomware, and malicious insiders.

Our report uncovers several staggering metrics that illustrate the industrialization of modern cybercrime:

• AI-related illicit activity skyrocketed by 1,500% in a single month at the end of 2025.
• 3.3 billion compromised credentials and cloud tokens have turned identity into the primary exploit vector.
• From January 2025 to December 2025, ransomware incidents rose by 53%, as attackers pivot from technical encryption to “pure-play” identity extortion.
• Vulnerability disclosures surged by 12% from January 2025 to December 2025, with the window between discovery and mass exploitation effectively vanishing.

These findings are derived from Flashpoint’s Primary Source Collection (PSC), a specialized operating model that collects intelligence directly from original sources, driven by an organization’s unique Priority Intelligence Requirements (PIR). The 2026 Global Threat Intelligence Report leverages this ground-truth data to provide a strategic framework for the year ahead. Download to gain:

1. A Clear Understanding of the New Convergence Between Identity and AI
   Discover how threat actors are preparing to transition from generative tools to sophisticated agentic frameworks. Learn how 3.3 billion compromised credentials are being weaponized via automated orchestration to bypass legacy defenses and exploit the connective tissue of modern corporate APIs.
   
2. Intelligence on the “Franchise Model” of Global Extortion
   Gain deep insight into the professionalized operations of today’s most prolific threat actors. From the industrial efficiency of RaaS groups like RansomHub and Clop to the market dominance of the next generation of infostealer malware, we break down the economics driving today’s cybercrime ecosystem.
   
3. A Blueprint for Proactive Defense and Risk Mitigation
   Leverage the latest trends, in-depth analysis, and data-driven insights driven by Primary Source Collection to bolster your security posture by identifying and proactively defending against rising attack vectors.

“As attackers automate exploitation of identity, vulnerabilities, and ransomware, defenders who rely on fragmented visibility will fall behind. To keep pace, organizations must ground their decisions in primary-source intelligence that is drawn from adversarial environments, so that decision-makers can get ahead of this accelerating threat cycle.”

Josh Lefkowitz, CEO & Co-Founder at Flashpoint

The Top Threats at a Glance

Our latest report identifies four driving themes shaping the 2026 threat landscape:

2026 Is the Era of Agentic-Based Cyberattacks

Flashpoint identified a 1,500% rise in AI-related illicit discussions between November and December 2025, signaling a rapid transition from criminal curiosity to the active development of malicious frameworks. Built on data pulled from criminal environments and shaped by fraud use cases, these systems scrape data, adjust messaging for specific targets, rotate infrastructure, and learn from failed attempts without the need for constant human involvement.

“2026 is the era of agentic-based cyberattacks. We’ve seen a 1,500% increase in AI-related illicit discussions in a single month, signaling increased interest in developing malicious frameworks. The discussions evolve into vibe-coded, AI-supported phishing lures, malware, and cybercrime venues. When iteration becomes cheap through automation, attackers can afford to fail repeatedly until they find a successful foothold.”

Ian Gray, Vice President of Cyber Threat Intelligence Operations at Flashpoint

Identity Is the New Exploit

Flashpoint observed over 11.1 million machines infected with infostealers in 2025, fueling a massive inventory of 3.3 billion stolen credentials and cloud tokens. The fundamental mechanics of cybercrime have shifted from breaking in to logging in, as attackers leverage stolen session cookies to behave like legitimate users.

The Patching Window Is Rapidly Closing

Vulnerability disclosures surged by 12% in 2025, with 1 in 3 (33%) vulnerabilities having publicly available exploit code. The strategic gap between discovery and weaponization is increasingly vanishing, as evidenced by mass exploitation of zero-day vulnerabilities in as little as 24 hours after discovery.

Ransomware Is Hacking the Person, Not the Code

As technical defenses against encryption harden, ransomware groups are pivoting to the path of least resistance: human trust. This approach has led to a 53% increase in ransomware, with RaaS groups being responsible for over 87% of all ransomware attacks.

Build Resilience in a Converged Landscape

The findings in the 2026 Global Threat Intelligence Report make one thing clear: incremental improvements to legacy security models are no longer sufficient. As adversaries transition to machine-speed operations, the strategic advantage shifts to organizations that can maintain visibility into the adversarial environments where these attacks are born.

Protecting organizations and communities requires an intelligence-first approach. Download Flashpoint’s 2026 Global Threat Intelligence Report to gain clarity and the data-driven insights needed to safeguard critical assets.

Blogs

Blog

What to Know About the Notepad++ Supply-Chain Attack

In this post we examine the mechanics of the CVE-2025-15556 supply-chain attack and provide actionable steps to secure your environment.

The cybersecurity community is still grappling with a sobering realization: one of the most ubiquitous tools in the developer’s toolkit, Notepad++, was hiding a critical vulnerability for over six months. Being so deeply embedded in daily workflows, many organizations did not realize they were vulnerable until a recent security update pulled back the curtain on a sophisticated Chinese state-sponsored campaign, dubbed “Lotus Blossom.”

Investigations have confirmed that the issue wasn’t just a coding error, it was a compromise at the hosting provider level. This means that for much of 2025, even organizations that followed best practices were still potentially open to backdoors from Chinese advanced persistent threat (APT) groups. Here is what you need to know to secure your environment.

Understanding the Notepad++ Vulnerability (CVE-2025-15556)

The vulnerability, tracked as CVE-2025-15556 (VulnDB ID: 430205), exploits a critical flaw in the Notepad++ updater component, WinGUP. In versions prior to the February 2026 patch, the updater failed to verify the file integrity signatures of downloaded installers.

By exploiting this lack of verification, threat actors are able to:

• Intercept legitimate update requests originating from WinGUp servers
• Redirect traffic to malicious servers via Man-in-the-Middle (MitM) attacks or DNS cache poisoning
• Deliver trojanized executables (disguised as update.exe) that appeared to be legitimate software patches

Leveraging this vulnerability, attackers have gained a persistent presence in high-value sectors. According to reports from Kaspersky, the impact has spanned government and telecommunications, critical infrastructure, and financial services.

How CVE-2025-15556 Works

The state-sponsored Lotus Blossom campaign was executed in three attack chains, between July and October 2025. Each phase evolved to evade detection by changing file sizes, IP addresses, and delivery methods.

Phase	Timeline (2025)	Execution Method	Payload
Chain #1	July – August	1MB NSIS installer (update.exe)	Multi-stage attack launching a Cobalt Strike beacon via ProShow.exe.
Chain #2	September	140KB NSIS installer (update.exe)	Rotated C2 URLs to maintain stealth while dropping a Cobalt Strike beacon.
Chain #3	October	Backdoor Deployment	Dropped BluetoothService.exe, log.DLL, and shellcode to establish the Chrysalis backdoor.

Mapping CVE-2025-15556 to MITRE ATT&CK

Flashpoint has mapped Lotus Blossom TTPs (tactics, tools, and procedures) to the MITRE ATT&CK framework. Flashpoint analysts have identified the following techniques:

Execution

Technique Title	ID	Recommendations
User Execution: Malicious File	T1204.002	M1040: Behavior Prevention on Endpoint M1038: Execution Prevention M1017: User Training
Native API	T1106	M1040: Behavior Prevention on Endpoint M1038: Execution Prevention
Command and Scripting Interpreter: Windows Command Shell	T1059.003	M1038: Execution Prevention

Persistence

Technique Title	ID	Recommendations
Hijack Execution Flow: DLL	T1574.002	M1013: Application Developer Guidance M1047: Audit M1038: Execution Prevention M1044: Restrict Library Loading M1051: Update Software
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	T1547.001	*MITRE currently does not list any mitigation guidance to combat this attack technique.
Create or Modify System Process: Windows Service	T1543.003	M1047: Audit M1040: Behavior Prevention on Endpoint M1045: Code Signing M1028: Operating System Configuration M1018: User Account Management

Defense Evasion

Technique Title	ID	Recommendations
Masquerading	T1036	M1049: Antivirus/Antimalware M1047: Audit M1040: Behavior Prevention on Endpoint M1045: Code Signing M1038: Execution Prevention M1022: Restrict File and Directory Permissions M1018: User Account Management M1017: User Training
Obfuscated Files or Information	T1027	M1049: Antivirus/Antimalware M1047: Audit M1040: Behavior Prevention on Endpoint M1017: User Training
Obfuscated Files or Information: Dynamic API Resolution	T1027.007	*MITRE currently does not list any mitigation guidance to combat this attack technique.
Deobfuscate/Decode Files or Information	T1140	*MITRE currently does not list any mitigation guidance to combat this attack technique.
Process Injection	T1055	M1040: Behavior Prevention on Endpoint M1026: Privileged Account Management
Reflective Code Loading	T1620	*MITRE currently does not list any mitigation guidance to combat this attack technique.
Execution Guardrails: Mutual Exclusion	T1480.002	M1055: Do Not Mitigate
Indicator Removal: File Deletion	T1070.004	*MITRE currently does not list any mitigation guidance to combat this attack technique.

Discovery

Technique Title	ID	Recommendations
File and Directory Discovery	T1083	*MITRE currently does not list any mitigation guidance to combat this attack technique.
Ingress Tool Transfer	T1105	M1031: Network Intrusion Prevention

Collection

Technique Title	ID	Recommendations
Data from Local System	T1005	M1057: Data Loss Prevention

Command and Control

Technique Title	ID	Recommendations
Application Layer Protocol: Web Protocols	T1071.001	M1031: Network Intrusion Prevention
Encrypted Channel	T1573	M1031: Network Intrusion Prevention M1020: SSL/TLS Inspection

Exfiltration

Technique Title	ID	Recommendations
Exfiltration Over C2 Channel	T1041	M1057: Data Loss Prevention M1031: Network Intrusion Prevention

Protecting Against CVE-2025-15556

Proactive defense requires not only reactive patching of CVE-2025-15556, but also active threat hunting using the TTPs identified by Flashpoint analysts. Flashpoint recommends the following actions:

1. Immediate Update: Ensure all instances of Notepad ++ are updated to v8.9.1 or higher immediately. This version enforces the signature verification that was missing in previous releases.
2. Audit System Paths: Scan for malicious file paths used for persistence.
3. Network Defense: Monitor and block traffic to malicious domains.
4. Endpoint Hardening: Implement Behavior Prevention on Endpoints (M1040) and Audit (M1047) to detect unauthorized registry run keys or new system services.

Outpace Threat Actors Using Flashpoint

Software trust is only as strong as the infrastructure behind it. As organizations respond to these recent updates, having best-in-class vulnerability intelligence and direct visibility into threat actor TTPs is the best defense.

Leveraging Flashpoint vulnerability intelligence, organizations can move beyond CVE and NVD, by gaining deeper technical analysis and MITRE ATT&CK mapping to defend against sophisticated threat actors. Request a demo to learn more.

Begin your free trial today.

Blogs

Blog

N-Day Vulnerability Trends: The Shrinking Window of Exposure and the Rise of “Turn-Key” Exploitation

In this post we explore the data-driven shrinkage of the Time to Exploit (TTE) window from 745 days to just 44, and examine why N-day vulnerabilities have become the “turn-key” weapon of choice for modern threat actors.

The race between defenders and threat actors has entered a new, more volatile phase: the rapidly accelerating exploitation of N-day vulnerabilities. Different from zero-days, N-day vulnerabilities are known security flaws that have been publicly disclosed but remain unpatched or unmitigated on an organization’s systems.

Historically, enterprises operated under the assumption of a “patching grace period,” the designated window of time allowed for a vendor to test and deploy a fix before a system is considered non-compliant or at high risk. However, this window is effectively collapsing, with Flashpoint finding that N-days now represent over 80% of all Known Exploited Vulnerabilities (KEVs) tracked over the past four years.

The Collapse of the Time to Exploit (TTE) Window

The most sobering trend for security operations (SecOps) and exposure management teams is the dramatic reduction in Time to Exploit (TTE). In 2020, the average TTE, the time between a vulnerability’s disclosure and its first observed exploitation, was 745 days. By 2025, Flashpoint found that this window has now plummeted to an average of just 44 days.

	2025	2024	2023	2022	2021	2020
Average TTE	44	115	296	405	518	745

This contraction represents a strategic shift in adversary tempo. Attackers are no longer waiting for complex, bespoke exploits; they are moving at breakneck speeds to weaponize public disclosures.

N-Days Provide a “Turn-Key” Exploit Advantage

Adversaries have gained a significant advantage through the rapid weaponization of researcher-published Proof-of-Concept (PoC) code. When a fully functional exploit is released alongside a vulnerability disclosure, it becomes a “turn-key” solution for attackers. By combining these ready-made exploits with internet-wide scanning tools like Shodan or FOFA, even unsophisticated threat actors can conduct mass exploitation across large segments of the internet in hours.

A prime example of this path of least resistance approach was observed in the leaked internal chat logs of the BlackBasta ransomware group. Analysis revealed that of the 65 CVEs discussed by the group, 54 were already known KEVs. Rather than spending resources on original zero-day research, threat actors are simply leveraging known, yet unpatched and exploitable vulnerabilities for their campaigns.

Defensive Software is a Primary Target for N-Days

The very software designed to protect enterprise firewalls, VPN gateways, and edge networking devices is consistently the most targeted category for both N-day and zero-day exploitation.

Because cybersecurity devices must be internet-facing to function, they provide a constant, unauthenticated attack surface. In 2025 alone, Flashpoint observed 37 N-days and 52 zero-days specifically targeting security and perimeter software. The requirement for these systems to remain open to external traffic means they will continue to be disproportionately targeted by advanced persistent threat (APT) groups and cybercriminals alike.

Attributing N-Day Attacks

While tracking the “how” of an attack is critical, tracking who is responsible remains a fragmented challenge for the industry. Attribution is often hampered by naming fatigue, where different vendors assign their own designated unique monikers to the same actor. For instance, the widely known threat actor group Lazarus has over 40 distinct designations across the industry, including “Diamond Sleet,” “NICKEL ACADEMY,” and “Guardians of Peace”.

Despite these naming complexities, global activity patterns remain clear. China remains the most active nation-state actor in the vulnerability exploitation space, consistently outpacing Russia, Iran, and North Korea in both the volume and scope of their campaigns.

Obstacles for Enterprise Security: Asset Blindness and the CVE Dependency Trap

Why are organizations struggling to keep pace? The primary factor isn’t a lack of effort, but a lack of visibility.

1. The Asset Inventory Gap

The single greatest breakthrough an enterprise can achieve is not a new AI tool, but a complete asset inventory. Most large organizations are lucky to have an accurate inventory of even 25% of their total assets. Without knowing what you own, vulnerability scans can take days or weeks to return results that the adversary is already using to probe your network.

2. The CVE Blindspot

Most traditional security tools are CVE-dependent. However, thousands of vulnerabilities are disclosed every year that never receive an official CVE ID. These “missing” vulnerabilities represent a massive blindspot for standard scanners. Intelligence-led exposure management requires looking beyond the CVE ecosystem into proprietary databases like Flashpoint’s VulnDB, which tracks over 105,000 vulnerabilities that public sources miss.

Move Towards Intelligence-Led Exposure Management Using Flashpoint

To survive in an era where weaponization can happen in under 24 hours, organizations must shift from reactive patching to a threat-informed and proactive security approach. This means:

• Prioritizing by Exploitability and Threat Actor Activity: Focus on vulnerabilities that are remotely exploitable and have known public exploits, rather than just high CVSS scores.
• Adopting an Asset-Inventory Approach: Moving away from slow, periodic scans in favor of continuous asset mapping that allows for immediate triage.
• Operationalizing Intelligence: Embedding real-time threat data directly into SOC and IR workflows to reduce the “mean time to action”.

The goal of exposure management is to look at your organization through the adversary’s lens. By understanding which N-days threat actors are actually discussing and weaponizing in the wild, defenders can finally start to close the window of exposure before a potential compromise can occur.

Flashpoint’s vulnerability threat intelligence can help your organization go from reactive to proactive. Request a demo today and gain access to quality vulnerability intelligence that enables intelligence-led exposure management.

Request a demo today.

Blogs

Blog

Flashpoint Weekly Vulnerability Insights and Prioritization Report

Week of December 20 – December 26, 2025

Anticipate, contextualize, and prioritize vulnerabilities to effectively address threats to your organization.

Flashpoint’s VulnDB documents over 400,000 vulnerabilities and has over 6,000 entries in Flashpoint’s KEV database, making it a critical resource as vulnerability exploitation rises. However, if your organization is relying solely on CVE data, you may be missing critical vulnerability metadata and insights that hinder timely remediation. That’s why we created this weekly series—where we surface and analyze the most high priority vulnerabilities security teams need to know about.

Key Vulnerabilities:
Week of December 20 – December 26, 2025

Foundational Prioritization

Of the vulnerabilities Flashpoint published this week, there are 34 that you can take immediate action on. They each have a solution, a public exploit exists, and are remotely exploitable. As such, these vulnerabilities are a great place to begin your prioritization efforts.

Diving Deeper – Urgent Vulnerabilities

Of the vulnerabilities Flashpoint published last week, four are highlighted in this week’s Vulnerability Insights and Prioritization Report because they contain one or more of the following criteria:

• Are in widely used products and are potentially enterprise-affecting
• Are exploited in the wild or have exploits available
• Allow full system compromise
• Can be exploited via the network alone or in combination with other vulnerabilities
• Have a solution to take action on

In addition, all of these vulnerabilities are easily discoverable and therefore should be investigated and fixed immediately.

To proactively address these vulnerabilities and ensure comprehensive coverage beyond publicly available sources on an ongoing basis, organizations can leverage Flashpoint Vulnerability Intelligence. Flashpoint provides comprehensive coverage encompassing IT, OT, IoT, CoTs, and open-source libraries and dependencies. It catalogs over 100,000 vulnerabilities that are not included in the NVD or lack a CVE ID, ensuring thorough coverage beyond publicly available sources. The vulnerabilities that are not covered by the NVD do not yet have CVE ID assigned and will be noted with a VulnDB ID.

CVE ID	Title	CVSS Scores (v2, v3, v4)	Exploit Status	Exploit Consequence	Ransomware Likelihood Score	Social Risk Score	Solution Availability
CVE-2025-33222	NVIDIA Isaac Launchable Unspecified Hardcoded Credentials	5.0 9.8 9.3	Private	Credential Disclosure	High	Low	Yes
CVE-2025-33223	NVIDIA Isaac Launchable Unspecified Improper Execution Privileges Remote Code Execution	10.0 9.8 9.3	Private	Remote Code Execution	High	Low	Yes
CVE-2025-68613	n8n Package for Node.js packages/workflow/src/expression-evaluator-proxy.ts Workflow Expression Evaluation Remote Code Execution	9.0 9.9 9.4	Public	Remote Code Execution	High	High	Yes
CVE-2025-14847	MongoDB transport/message_compressor_zlib.cpp ZlibMessageCompressor::decompressData() Function Zlib Compressed Protocol Header Handling Remote Uninitialized Memory Disclosure (Mongobleed)	10.0 9.8 9.3	Public	Uninitialized Memory Disclosure	High	High	Yes

Flashpoint Ignite lays all of these components out. Below is an example of what this vulnerability record for CVE-2025-33223 looks like.

Analyst Comments on the Notable Vulnerabilities

Below, Flashpoint analysts describe the five vulnerabilities highlighted above as vulnerabilities that should be of focus for remediation if your organization is exposed.

CVE-2025-33222

NVIDIA Isaac Launchable contains a flaw that is triggered by the use of unspecified hardcoded credentials. This may allow a remote attacker to trivially gain privileged access to the program.

CVE-2025-33223

NVIDIA Isaac Launchable contains an unspecified flaw that is triggered as certain activities are executed with unnecessary privileges. This may allow a remote attacker to potentially execute arbitrary code.

CVE-2025-68613

n8n Package for Node.js contains a flaw in packages/workflow/src/expression-evaluator-proxy.ts that is triggered as workflow expressions are evaluated in an improperly isolated execution context. This may allow an authenticated, remote attacker to execute arbitrary code with the privileges of the n8n process.

CVE-2025-14847

MongoDB contains a flaw in the ZlibMessageCompressor::decompressData() function in mongo/transport/message_compressor_zlib.cpp that is triggered when handling mismatched length fields in Zlib compressed protocol headers. This may allow a remote attacker to disclose uninitialized memory contents on the heap.

Previously Highlighted Vulnerabilities

CVE/VulnDB ID	Flashpoint Published Date
CVE-2025-21218	Week of January 15, 2025
CVE-2024-57811	Week of January 15, 2025
CVE-2024-55591	Week of January 15, 2025
CVE-2025-23006	Week of January 22, 2025
CVE-2025-20156	Week of January 22, 2025
CVE-2024-50664	Week of January 22, 2025
CVE-2025-24085	Week of January 29, 2025
CVE-2024-40890	Week of January 29, 2025
CVE-2024-40891	Week of January 29, 2025
VulnDB ID: 389414	Week of January 29, 2025
CVE-2025-25181	Week of February 5, 2025
CVE-2024-40890	Week of February 5, 2025
CVE-2024-40891	Week of February 5, 2025
CVE-2024-8266	Week of February 12, 2025
CVE-2025-0108	Week of February 12, 2025
CVE-2025-24472	Week of February 12, 2025
CVE-2025-21355	Week of February 24, 2025
CVE-2025-26613	Week of February 24, 2025
CVE-2024-13789	Week of February 24, 2025
CVE-2025-1539	Week of February 24, 2025
CVE-2025-27364	Week of March 3, 2025
CVE-2025-27140	Week of March 3, 2025
CVE-2025-27135	Week of March 3, 2025
CVE-2024-8420	Week of March 3, 2025
CVE-2024-56196	Week of March 10, 2025
CVE-2025-27554	Week of March 10, 2025
CVE-2025-22224	Week of March 10, 2025
CVE-2025-1393	Week of March 10, 2025
CVE-2025-24201	Week of March 17, 2025
CVE-2025-27363	Week of March 17, 2025
CVE-2025-2000	Week of March 17, 2025
CVE-2025-27636 CVE-2025-29891	Week of March 17, 2025
CVE-2025-1496	Week of March 24, 2025
CVE-2025-27781	Week of March 24, 2025
CVE-2025-29913	Week of March 24, 2025
CVE-2025-2746	Week of March 24, 2025
CVE-2025-29927	Week of March 24, 2025
CVE-2025-1974 CVE-2025-2787	Week of March 31, 2025
CVE-2025-30259	Week of March 31, 2025
CVE-2025-2783	Week of March 31, 2025
CVE-2025-30216	Week of March 31, 2025
CVE-2025-22457	Week of April 2, 2025
CVE-2025-2071	Week of April 2, 2025
CVE-2025-30356	Week of April 2, 2025
CVE-2025-3015	Week of April 2, 2025
CVE-2025-31129	Week of April 2, 2025
CVE-2025-3248	Week of April 7, 2025
CVE-2025-27797	Week of April 7, 2025
CVE-2025-27690	Week of April 7, 2025
CVE-2025-32375	Week of April 7, 2025
VulnDB ID: 398725	Week of April 7, 2025
CVE-2025-32433	Week of April 12, 2025
CVE-2025-1980	Week of April 12, 2025
CVE-2025-32068	Week of April 12, 2025
CVE-2025-31201	Week of April 12, 2025
CVE-2025-3495	Week of April 12, 2025
CVE-2025-31324	Week of April 17, 2025
CVE-2025-42599	Week of April 17, 2025
CVE-2025-32445	Week of April 17, 2025
VulnDB ID: 400516	Week of April 17, 2025
CVE-2025-22372	Week of April 17, 2025
CVE-2025-32432	Week of April 29, 2025
CVE-2025-24522	Week of April 29, 2025
CVE-2025-46348	Week of April 29, 2025
CVE-2025-43858	Week of April 29, 2025
CVE-2025-32444	Week of April 29, 2025
CVE-2025-20188	Week of May 3, 2025
CVE-2025-29972	Week of May 3, 2025
CVE-2025-32819	Week of May 3, 2025
CVE-2025-27007	Week of May 3, 2025
VulnDB ID: 402907	Week of May 3, 2025
VulnDB ID: 405228	Week of May 17, 2025
CVE-2025-47277	Week of May 17, 2025
CVE-2025-34027	Week of May 17, 2025
CVE-2025-47646	Week of May 17, 2025
VulnDB ID: 405269	Week of May 17, 2025
VulnDB ID: 406046	Week of May 19, 2025
CVE-2025-48926	Week of May 19, 2025
CVE-2025-47282	Week of May 19, 2025
CVE-2025-48054	Week of May 19, 2025
CVE-2025-41651	Week of May 19, 2025
CVE-2025-20289	Week of June 3, 2025
CVE-2025-5597	Week of June 3, 2025
CVE-2025-20674	Week of June 3, 2025
CVE-2025-5622	Week of June 3, 2025
CVE-2025-5419	Week of June 3, 2025
CVE-2025-33053	Week of June 7, 2025
CVE-2025-5353	Week of June 7, 2025
CVE-2025-22455	Week of June 7, 2025
CVE-2025-43200	Week of June 7, 2025
CVE-2025-27819	Week of June 7, 2025
CVE-2025-49132	Week of June 13, 2025
CVE-2025-49136	Week of June 13, 2025
CVE-2025-50201	Week of June 13, 2025
CVE-2025-49125	Week of June 13, 2025
CVE-2025-24288	Week of June 13, 2025
CVE-2025-6543	Week of June 21, 2025
CVE-2025-3699	Week of June 21, 2025
CVE-2025-34046	Week of June 21, 2025
CVE-2025-34036	Week of June 21, 2025
CVE-2025-34044	Week of June 21, 2025
CVE-2025-7503	Week of July 12, 2025
CVE-2025-6558	Week of July 12, 2025
VulnDB ID: 411705	Week of July 12, 2025
VulnDB ID: 411704	Week of July 12, 2025
CVE-2025-6222	Week of July 12, 2025
CVE-2025-54309	Week of July 18, 2025
CVE-2025-53771	Week of July 18, 2025
CVE-2025-53770	Week of July 18, 2025
CVE-2025-54122	Week of July 18, 2025
CVE-2025-52166	Week of July 18, 2025
CVE-2025-53942	Week of July 25, 2025
CVE-2025-46811	Week of July 25, 2025
CVE-2025-52452	Week of July 25, 2025
CVE-2025-41680	Week of July 25, 2025
CVE-2025-34143	Week of July 25, 2025
CVE-2025-50454	Week of August 1, 2025
CVE-2025-8875	Week of August 1, 2025
CVE-2025-8876	Week of August 1, 2025
CVE-2025-55150	Week of August 1, 2025
CVE-2025-25256	Week of August 1, 2025
CVE-2025-43300	Week of August 16, 2025
CVE-2025-34153	Week of August 16, 2025
CVE-2025-48148	Week of August 16, 2025
VulnDB ID: 416058	Week of August 16, 2025
CVE-2025-32992	Week of August 16, 2025
CVE-2025-7775	Week of August 24, 2025
CVE-2025-8424	Week of August 24, 2025
CVE-2025-34159	Week of August 24, 2025
CVE-2025-57819	Week of August 24, 2025
CVE-2025-7426	Week of August 24, 2025
CVE-2025-58367	Week of September 1, 2025
CVE-2025-58159	Week of September 1, 2025
CVE-2025-58048	Week of September 1, 2025
CVE-2025-39247	Week of September 1, 2025
CVE-2025-8857	Week of September 1, 2025
CVE-2025-58321	Week of September 8, 2025
CVE-2025-58366	Week of September 8, 2025
CVE-2025-58371	Week of September 8, 2025
CVE-2025-55728	Week of September 8, 2025
CVE-2025-55190	Week of September 8, 2025
VulnDB ID: 419253	Week of September 13, 2025
CVE-2025-10035	Week of September 13, 2025
CVE-2025-59346	Week of September 13, 2025
CVE-2025-55727	Week of September 13, 2025
CVE-2025-10159	Week of September 13, 2025
CVE-2025-20363	Week of September 20, 2025
CVE-2025-20333	Week of September 20, 2025
CVE-2022-4980	Week of September 20, 2025
VulnDB ID: 420451	Week of September 20, 2025
CVE-2025-9900	Week of September 20, 2025
CVE-2025-52906	Week of September 27, 2025
CVE-2025-51495	Week of September 27, 2025
CVE-2025-27224	Week of September 27, 2025
CVE-2025-27223	Week of September 27, 2025
CVE-2025-54875	Week of September 27, 2025
CVE-2025-41244	Week of September 27, 2025
CVE-2025-61928	Week of October 6, 2025
CVE-2025-61882	Week of October 6, 2025
CVE-2025-49844	Week of October 6 2025
CVE-2025-57870	Week of October 6, 2025
CVE-2025-34224	Week of October 6, 2025
CVE-2025-34222	Week of October 6, 2025
CVE-2025-40765	Week of October 11, 2025
CVE-2025-59230	Week of October 11, 2025
CVE-2025-24990	Week of October 11, 2025
CVE-2025-61884	Week of October 11, 2025
CVE-2025-41430	Week of October 11, 2025
VulnDB ID: 424051	Week of October 18, 2025
CVE-2025-62645	Week of October 18, 2025
CVE-2025-61932	Week of October 18, 2025
CVE-2025-59503	Week of October 18, 2025
CVE-2025-43995	Week of October 18, 2025
CVE-2025-62168	Week of October 18, 2025
VulnDB ID: 425182	Week of October 25, 2025
CVE-2025-62713	Week of October 25, 2025
CVE-2025-54964	Week of October 25, 2025
CVE-2024-58274	Week of October 25, 2025
CVE-2025-41723	Week of October 25, 2025
CVE-2025-20354	Week of November 1, 2025
CVE-2025-11953	Week of November 1, 2025
CVE-2025-60854	Week of November 1, 2025
CVE-2025-64095	Week of November 1, 2025
CVE-2025-11833	Week of November 1, 2025
CVE-2025-64446	Week of November 8, 2025
CVE-2025-36250	Week of November 8, 2025
CVE-2025-64400	Week of November 8, 2025
CVE-2025-12686	Week of November 8, 2025
CVE-2025-59118	Week of November 8, 2025
VulnDB ID: 426231	Week of November 8, 2025
VulnDB ID: 427979	Week of November 22, 2025
CVE-2025-55796	Week of November 22, 2025
CVE-2025-64428	Week of November 22, 2025
CVE-2025-62703	Week of November 22, 2025
VulnDB ID: 428193	Week of November 22, 2025
CVE-2025-65018	Week of November 22, 2025
CVE-2025-54347	Week of November 22, 2025
CVE-2025-55182	Week of November 29, 2025
CVE-2024-14007	Week of November 29, 2025
CVE-2025-66399	Week of November 29, 2025
CVE-2022-35420	Week of November 29, 2025
CVE-2025-66516	Week of November 29, 2025
CVE-2025-59366	Week of November 29, 2025
CVE-2025-14174	Week of December 6, 2026
CVE-2025-43529	Week of December 6, 2026
CVE-2025-8110	Week of December 6, 2026
CVE-2025-59719	Week of December 6, 2026
CVE-2025-59718	Week of December 6, 2026
CVE-2025-14087	Week of December 6, 2026
CVE-2025-62221	Week of December 6, 2026

Transform Vulnerability Management with Flashpoint

Request a demo today to see how Flashpoint can transform your vulnerability intelligence, vulnerability management, and exposure identification program.

Request a demo today.

Blogs

Blog

Digital Supply Chain Risk: Critical Vulnerability Affecting React Allows for Unauthorized Remote Code Execution

CVE-2025-55182 (VulnDB ID: 428930), is a severe, unauthenticated RCE impacting a major component of React and its ecosystem, putting global applications at immediate, high-fidelity risk.

The React team disclosed a critical vulnerability impacting three products in the React Server Components (RSC) that allows for unauthenticated remote code execution. 

Flashpoint’s vulnerability research team assesses significant enterprise and supply chain risk given React’s ubiquity: the impacted JavaScript library underpins modern UIs, with 168,640 dependents and more than 51 million weekly downloads.

How CVE-2025-55182 Works

CVE-2025-55182 (VulnDB ID: 428930) impacts all React versions since 19.0.0, meaning that this issue has been potentially exploitable since November 14, 2024. This vulnerability stems from how React handles payloads sent to React Server Function endpoints and deserializes them.

Depending on the implementation of this library, a remote, unauthenticated threat actor could send a crafted payload that would be deserialized in a way that causes remote code execution. This would lead to a total compromise of the system hosting the application, allowing for malware such as infostealers, ransomware, or cryptojackers (cryptocurrency mining) to be downloaded.

A working exploit for CVE-2025-55182 has already been published that is effective against some installations. In addition, Amazon has reported that two threat actors, attributed to Chinese Advanced Persistent Threat Groups (APTs), have begun to exploit this vulnerability. Those groups are:

• Earth Lamia (STAC6451, REF0657, CL-STA-0048)
• Jackpot Panda (iSoon, DRAGNET PANDA, Anxun Information, deepclif, Poison Carp, Houndstooth Typhoon)

Understanding the Impact and Scope of CVE-2025-55182

It is critical that security teams fully understand the potential downstream scope and impact so that they can fully focus on mitigation, rather than time-consuming research. While the vendor has provided a full disclosure, there are several important caveats to understand about CVE-2025-55182:

1. Applications not implementing any React Server Function endpoints may still be vulnerable as long as it supports React Server Components.
2. If an application’s React code does not use a server, it is not affected by this vulnerability.
3. Applications that do not use a framework, bundler, or bundler plugins that support React Server Components are unaffected by this vulnerability.

Additionally, several React frameworks and bundlers have been discovered to leverage vulnerable React packages in various ways. The following frameworks and bundlers are known to be affected:

• next
• react-router
• waku
• @parcel/rsc
• @vitejs/plugin-rsc
• rwsdk

NPMJS.com currently shows that the react-dom package, which is effectively part of React, has 168,640 dependents. This means that an incredible number of enterprise applications are likely to be affected. Nearly every commercial application is built on hundreds, sometimes thousands of components and dependencies. Furthermore, applications coded via Vibe and similar technology are also likely to leverage React: potentially amplifying the downstream risk this vulnerability poses.

How to Mitigate CVE-2025-55182

For mitigation, the React library has released versions 19.0.1, 19.1.2, and 19.2.1 that resolve the issue. Flashpoint advises organizations to upgrade their respective libraries urgently. Security teams leveraging dynamic SBOMs (Software Bill of Materials) can drastically increase risk mapping and triage for deployed React versions.

CloudFlare has upgraded their web-application firewall (WAF) to protect against CVE-2025-55182. It is available for both free and paid plans but requires that React application traffic is proxied through the CloudFlare WAF.

To avoid confusion, security teams should ignore CVE-2025-66478. It has been rejected for being a duplicate of the preferred CVE-2025-55182.

Mitigate Critical Vulnerabilities Using Flashpoint

Flashpoint strongly recommends security teams treat this vulnerability with utmost urgency. Our vulnerability research team will continue to monitor this vulnerability and its downstream impacts. All updates will be provided via Flashpoint’s VulnDB. 

Request a demo today and gain access to quality vulnerability intelligence that helps address critical threats in a timely manner.

Request a demo today.