Vercel vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 5 Vercel CVEs published between 2025-03-15 and 2025-12-15. The busiest month was 2025-12 (4 new CVEs). 1 of them (20%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked Vercel CVEs.

• CVE-2025-55182critical 10KEVRansomwareEPSS 84.9%2025-12-03
• CVE-2025-29927critical 9.1EPSS 92.1%2025-03-21
• CVE-2025-55184high 7.5EPSS 21.1%2025-12-11
• CVE-2025-55183medium 5.3EPSS 21%2025-12-11
• CVE-2025-67779high 7.5EPSS 0.2%2025-12-12

Products affected

Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 1 distinct Vercel product is affected. The most frequently affected:

• Next.js 5 CVEs

Threat activity

25 tracked threat campaigns reference Vercel products or exploit Vercel CVEs:

• Vercel Confirms KVM Zero-Day Guest-to-Host VM Escape (Root on Host) via Sandbox Bug Bounty; $50,000 Bounty AwardedHIGH2026-10-04
• OAuth-Token Supply-Chain Compromise Enables Attacker Access to Google Workspace: The Vercel and Composio BreachesHIGH2026-08-14
• The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payoutsHIGH2026-07-14
• FulcrumSec Double-Extortion Data Theft of Global Schools Foundation (GSF) EdTech Network via Unrotated 2022 MongoDB CredentialsHIGH2026-07-11
• The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate ProgramCRITICAL2026-07-06
• Fake IT Support Calls on Microsoft Teams Push EtherRAT — Node.js RAT Using EtherHiding (Ethereum Smart Contract C2), Linked to React2Shell (CVE-2025-55182) Exploitation ChainHIGH2026-07-06
• SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt StrikeHIGH2026-07-03
• ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python Packages to Backdoor Security ResearchersHIGH2026-07-02
• ChocoPoC Campaign: Trojanised PoC Exploits and PyPI Packages Deliver Python RAT Using Mapbox Datasets API as Dead-Drop C2HIGH2026-07-02
• ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits Targeting Security ResearchersHIGH2026-07-01
• SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark CampaignHIGH2026-06-27
• AI Skill-Scanner Bypass — ClawHub, Cisco & Vercel Malicious-Skill Detectors Evaded via Truncation, .pyc Bytecode, Archive Indirection & Prompt Injection (Trail of Bits)HIGH2026-06-07
• SHADOW-EARTH-053 — China-Aligned Cyberespionage Campaign Exploiting Microsoft Exchange (ProxyLogon CVE-2021-26855/26857/26858/27065) and IIS to Deploy GODZILLA Web Shells and ShadowPadHIGH2026-05-11
• PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703)CRITICAL2026-05-07
• Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret Loader in Git Hooks via precommit.vercel.app — Contagious Interview / TaskJacker Evolution (May 2026)HIGH2026-05-06
• AccountDumpling — Vietnamese-Linked Facebook Business Hijacking Campaign Abusing Google AppSheet (~30,000 Compromised Accounts)HIGH2026-05-04
• Bissa Scanner — AI-Assisted Mass Exploitation of CVE-2025-55182 (React Server Components RCE) and CVE-2025-9501 (W3 Total Cache)CRITICAL2026-04-27
• Bissa Scanner — AI-Assisted Mass Exploitation and Credential Harvesting Campaign (@BonJoviGoesHard / Dr. Tube)HIGH2026-04-22
• Vercel April 2026 Security Incident — Context.ai OAuth Supply Chain Compromise Exposing Employee Records, Plaintext Environment Variables, and npm/GitHub TokensHIGH2026-04-21
• Vercel April 2026 Security Incident — Context.ai OAuth Compromise Leads to Google Workspace Takeover and Customer Environment Variable ExposureHIGH2026-04-20
• Escalating Kubernetes Attacks: React2Shell (CVE-2025-55182), Slow Pisces, and Cloud-Native Threat ActorsCRITICAL2026-04-06
• TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 PayloadCRITICAL2026-03-31
• EtherRAT — Node.js Backdoor with Ethereum Blockchain C2 (EtherHiding) Linked to DPRK Contagious InterviewCRITICAL2026-03-27
• TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain AttacksCRITICAL2026-03-26
• React2Shell CVE-2025-55182 — Multiple Threat Actors Actively Exploiting React Server Components RCE (CVSS 10.0)CRITICAL2026-02-13

Threat actors targeting Vercel

Named threat actors attributed to campaigns that involve Vercel products or CVEs, with the number of linked campaigns:

• TeamPCP 3
• Bling Libra 2
• BonJoviGoesHard 2
• ShinyHunters 2
• Andariel 1
• APT38 1
• Earth Lamia 1
• Jade Sleet 1
• Lazarus Group 1
• PCPJack 1
• SHADOW-EARTH-053 1
• Slow Pisces 1

How to prioritise Vercel patching

This order follows the data Threadlinqs holds for Vercel, not a generic severity checklist:

• 1 of 5 Vercel CVEs (20%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2025-55182.
• 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
• Outside KEV, the highest EPSS scores are CVE-2025-29927 (92.1%), CVE-2025-55184 (21.1%), CVE-2025-55183 (21%).
• 2 CVEs score Critical and 2 High on CVSS v3 (maximum 10, average 7.9); sequence these after KEV and high-EPSS items.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.