Daily brief 2026-10-22: Meta React Server Components and what businesses should patch

CVE-2025-55182 (Meta React Server Components): Meta React Server Components Remote Code Execution Vulnerability. Severity CRITICAL, CVSS 10, EPSS 99.8%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2025-10035 (Fortra GoAnywhere MFT): Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability. Severity CRITICAL, CVSS 9.8, EPSS 99.8%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2025-61882 (Oracle E-Business Suite): Oracle E-Business Suite Unspecified Vulnerability. Severity CRITICAL, CVSS 9.8, EPSS 99.7%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2025-31324 (SAP NetWeaver): SAP NetWeaver Unrestricted File Upload Vulnerability. Severity CRITICAL, CVSS 9.8, EPSS 99.5%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2024-50623 (Cleo Multiple Products): Cleo Multiple Products Unrestricted File Upload Vulnerability. Severity CRITICAL, CVSS 9.8, EPSS 98.6%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2026-35273 (Oracle PeopleSoft Enterprise PeopleTools): Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability. Severity CRITICAL, CVSS 9.8, EPSS 96.7%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

File transfer & backup tools: CVE-2025-10035, CVE-2024-50623. See the Business Apps page for what to ask your provider.

Prioritize anything in CISA KEV and anything internet-facing (VPNs, firewalls, web servers, remote-support tools). Confirm patch status across every client tenant, and kill active sessions after patching gateway appliances.

CVE-2025-55182: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-10035: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-61882: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-55182 affects Meta React Server Components. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

Ask your IT provider which of these products you run, and get written confirmation they are patched or mitigated.

Enforce MFA, keep tested offline backups, and make sure remote access is not exposed without protection.