VulnRadar

Data against noise.

Built with NaN
Page generated: 11 Nov 2026, 10:46 UTC
← Dashboard

CVE-2025-66644

Log4Shell

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

CVSS 7.2 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
2.5/10
REALITY · THREAT PRIORITY
8.1/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.2: +1.08
  • Fresh EPSS: 3.33%: +0.02

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 27 documents and public datasets.

Hype components

Headline sample (25%)
30/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
100/100
HYPE TOTAL26/100

Sources and documents

Aikido Security
Press · 30 Oct 2026, 03:27 · What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained - Aikido Security
Cybersecurity Dive
Press · 07 Apr 2026, 07:00 · React2Shell vulnerability helps hackers steal credentials, AI platform keys and other sensitive data - Cybersecurity Dive
Dark Reading
Press · 06 Apr 2026, 07:00 · Automated Credential Harvesting Campaign Exploits React2Shell Flaw - Dark Reading
BleepingComputer
Press · 05 Apr 2026, 07:00 · Hackers exploit React2Shell in automated credential theft campaign - BleepingComputer
SecurityWeek
Press · 03 Apr 2026, 07:00 · React2Shell Exploited in Large-Scale Credential Harvesting Campaign - SecurityWeek
See all 27 source documents
Cisco Talos Blog
Press · 02 Apr 2026, 07:00 · UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications - Cisco Talos Blog
Darktrace
Press · 10 Feb 2026, 08:00 · AI/LLM-Generated Malware Used to Exploit React2Shell - Darktrace
The Hacker News
Press · 05 Feb 2026, 08:00 · Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign - The Hacker News
Cybersecurity Dive
Press · 04 Feb 2026, 08:00 · React2Shell exploitation undergoes significant change in threat activity - Cybersecurity Dive
GreyNoise
Press · 02 Feb 2026, 08:00 · React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic - GreyNoise
Recorded Future
Press · 13 Jan 2026, 08:00 · December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity - Recorded Future
Resecurity
Press · 24 Dec 2025, 08:00 · React2Shell Explained (CVE-2025-55182): From Vulnerability Discovery to Exploitation - Resecurity
CyberScoop
Press · 17 Dec 2025, 08:00 · React2Shell fallout spreads to sensitive targets as public exploits hit all-time high - CyberScoop
The Hacker News
Press · 16 Dec 2025, 08:00 · React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors - The Hacker News
Microsoft
Press · 15 Dec 2025, 08:00 · Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components - Microsoft
Google Cloud
Press · 12 Dec 2025, 08:00 · Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) - Google Cloud
Cloudflare Blog
Press · 11 Dec 2025, 08:00 · React2Shell and related RSC vulnerabilities threat brief: early exploitation activity and threat actor techniques - Cloudflare Blog
Huntress
Press · 09 Dec 2025, 08:00 · PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182 - Huntress
Recorded Future
Press · 08 Dec 2025, 08:00 · Critical React2Shell Vulnerability Under Active Exploitation by Chinese Threat Actors - Recorded Future
wiz.io
Press · 08 Dec 2025, 08:00 · React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182 - wiz.io
Cyber Daily
Press · 05 Dec 2025, 08:00 · CISA warns of D-Link router vulnerability exploitation - Cyber Daily
Check Point Blog
Press · 05 Dec 2025, 08:00 · What is “React2Shell” (CVE-2025-55182) - in Plain English - and Why Check Point CloudGuard WAF Customers Carried on with Their Day - Check Point Blog
Sonatype
Press · 04 Dec 2025, 08:00 · Serious React2Shell Vulnerabilities Require Immediate Attention - Sonatype
Amazon Web Services (AWS)
Press · 04 Dec 2025, 08:00 · China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) - Amazon Web Services (AWS)
Rapid7
Press · 04 Dec 2025, 08:00 · React2Shell (CVE-2025-55182) - Critical unauthenticated RCE affecting React Server Components - Rapid7
SecurityWeek
Press · 04 Dec 2025, 08:00 · React2Shell: In-the-Wild Exploitation Expected for Critical React Vulnerability - SecurityWeek
wiz.io
Press · 03 Dec 2025, 08:00 · React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability - wiz.io

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 0.0Reality 8.102 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 3.0Reality 8.102 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 2.5Reality 8.1Nov 2Nov 2Nov 2

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.2; EPSS 3.3%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
network access, high privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:45.560576+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
03 Dec 2025, 08:00
Published
05 Dec 2025, 00:00
Added to the CISA KEV catalog
08 Dec 2025, 00:00
Latest press mention
30 Oct 2026, 03:27
Score calculated
05 Nov 2026, 13:59
Name
Log4Shell
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar