Facebook vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 5 Facebook CVEs published between 2019-05-15 and 2025-12-15. The busiest month was 2025-12 (4 new CVEs). 2 of them (40%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked Facebook CVEs.

• CVE-2025-55182critical 10KEVRansomwareEPSS 84.9%2025-12-03
• CVE-2019-3568critical 9.8KEVEPSS 39.2%2019-05-14
• CVE-2025-55184high 7.5EPSS 21.1%2025-12-11
• CVE-2025-55183medium 5.3EPSS 21%2025-12-11
• CVE-2025-67779high 7.5EPSS 0.2%2025-12-12

Products affected

Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 7 distinct Facebook products are affected. The most frequently affected:

• React 4 CVEs
• WhatsApp Business for Android 1 CVE
• WhatsApp Business for iOS 1 CVE
• WhatsApp for Android 1 CVE
• WhatsApp for Tizen 1 CVE
• WhatsApp for Windows Phone 1 CVE
• WhatsApp for iOS 1 CVE

Threat activity

19 tracked threat campaigns reference Facebook products or exploit Facebook CVEs:

• The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payoutsHIGH2026-07-14
• FulcrumSec Double-Extortion Data Theft of Global Schools Foundation (GSF) EdTech Network via Unrotated 2022 MongoDB CredentialsHIGH2026-07-11
• The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate ProgramCRITICAL2026-07-06
• Fake IT Support Calls on Microsoft Teams Push EtherRAT — Node.js RAT Using EtherHiding (Ethereum Smart Contract C2), Linked to React2Shell (CVE-2025-55182) Exploitation ChainHIGH2026-07-06
• SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt StrikeHIGH2026-07-03
• ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python Packages to Backdoor Security ResearchersHIGH2026-07-02
• ChocoPoC Campaign: Trojanised PoC Exploits and PyPI Packages Deliver Python RAT Using Mapbox Datasets API as Dead-Drop C2HIGH2026-07-02
• ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits Targeting Security ResearchersHIGH2026-07-01
• SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark CampaignHIGH2026-06-27
• NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)HIGH2026-06-09
• SHADOW-EARTH-053 — China-Aligned Cyberespionage Campaign Exploiting Microsoft Exchange (ProxyLogon CVE-2021-26855/26857/26858/27065) and IIS to Deploy GODZILLA Web Shells and ShadowPadHIGH2026-05-11
• PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703)CRITICAL2026-05-07
• Bissa Scanner — AI-Assisted Mass Exploitation of CVE-2025-55182 (React Server Components RCE) and CVE-2025-9501 (W3 Total Cache)CRITICAL2026-04-27
• Bissa Scanner — AI-Assisted Mass Exploitation and Credential Harvesting Campaign (@BonJoviGoesHard / Dr. Tube)HIGH2026-04-22
• Escalating Kubernetes Attacks: React2Shell (CVE-2025-55182), Slow Pisces, and Cloud-Native Threat ActorsCRITICAL2026-04-06
• TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 PayloadCRITICAL2026-03-31
• EtherRAT — Node.js Backdoor with Ethereum Blockchain C2 (EtherHiding) Linked to DPRK Contagious InterviewCRITICAL2026-03-27
• TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain AttacksCRITICAL2026-03-26
• React2Shell CVE-2025-55182 — Multiple Threat Actors Actively Exploiting React Server Components RCE (CVSS 10.0)CRITICAL2026-02-13

Threat actors targeting Facebook

Named threat actors attributed to campaigns that involve Facebook products or CVEs, with the number of linked campaigns:

• TeamPCP 3
• BonJoviGoesHard 2
• Earth Lamia 1
• Jade Sleet 1
• NSO Group 1
• PCPJack 1
• SHADOW-EARTH-053 1
• Slow Pisces 1
• StrikeShark 1
• The Gentlemen 1
• TraderTraitor 1
• Vect Ransomware 1

How to prioritise Facebook patching

This order follows the data Threadlinqs holds for Facebook, not a generic severity checklist:

• 2 of 5 Facebook CVEs (40%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2025-55182, CVE-2019-3568.
• 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
• Outside KEV, the highest EPSS scores are CVE-2025-55184 (21.1%), CVE-2025-55183 (21%), CVE-2025-67779 (0.2%).
• 2 CVEs score Critical and 2 High on CVSS v3 (maximum 10, average 8); sequence these after KEV and high-EPSS items.
• 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.