Look for exploit-shaped HTTP requests, unusual headers tied to React Server Components, unexpected command execution on the server and file writes to temporary directories. Those signals indicate the issue has moved from vulnerability discovery to active exploitation and require host-level investigation as well as patching.
What the active exploitation signal looks like in practice
Once a React exploit is no longer theoretical, the evidence usually shifts from scanning noise to a repeatable chain of malicious requests and host effects. Focus on requests that are shaped to trigger React Server Components behaviour, especially when they carry unusual headers, malformed payloads, or patterns that do not match normal application traffic. If the request pattern is followed by server-side command execution or new files appearing in temporary paths, treat it as live exploitation rather than curiosity testing.
That distinction matters because the defensive response changes immediately. A vulnerability that is merely reachable can often be patched on a normal cycle, but a vulnerability that is already being exercised requires investigation of the host, the timeline of requests, and any post-exploitation activity. MITRE ATT&CK Enterprise Matrix is useful here because it helps map the observed behaviour to exploitation, execution, and follow-on actions.
In other words, the practical signal is not just “someone touched the endpoint.” It is the combination of exploit-shaped input and a corresponding change in process or file state that should move the event into incident territory.
Which artefacts are most worth confirming first
The strongest early indicators are the artefacts that tie the request to a real compromise path. Check web logs for anomalies in header structure, request sequencing, content type, and path usage around React-related routes. Then correlate those entries with process telemetry and filesystem activity on the application host. If a request is immediately followed by shell invocation, interpreter launch, or suspicious writes into temporary directories, you have a stronger case that the attacker has crossed from probing into execution.
Temporary directories matter because they are often used as staging space for short-lived payloads, dropped scripts, or intermediate artefacts created during exploitation. CISA Known Exploited Vulnerabilities Catalog is the right external reference when you need to determine whether the underlying weakness is already associated with confirmed active abuse, while NIST National Vulnerability Database remains the baseline source for CVE context and affected versions.
When available, exploit likelihood signals such as FIRST EPSS can help prioritise which exposed React instances deserve immediate attention first, but confirmed host activity always outranks probabilistic scoring.
How to separate alert noise from real compromise
Exploit traffic often looks odd by design, but odd traffic alone is not enough. What makes the event actionable is a direct linkage between the incoming request and a host-level side effect. Look for a tight time correlation between suspicious HTTP requests and command execution, new child processes, unexpected file writes, or short-lived artefacts that disappear after execution. If those effects repeat across multiple requests or across several hosts, the probability of active exploitation rises quickly.
The most useful internal reference for this type of pattern is The State of NHI & AI Agent Breach Report 2026, which discusses real-world breach patterns where stolen secrets, compromised service accounts, and exploit-driven access paths lead to follow-on abuse. The anchor point for the reader is the same: once attack traffic is producing execution or write-side effects, you are no longer dealing with a harmless test.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | React exploitation attempts are public-facing app abuse that can lead to execution. |
| T1059 — Command and Scripting Interpreter | Unexpected server command execution is a core sign of active exploitation. | |
| Recommendation — Map suspicious React request patterns to T1190 and hunt for execution plus post-exploit activity. Alert on spawned interpreters from the web process and isolate the host. | ||
| NIST CSF 2.0 | DE.CM-01 — Security Continuous Monitoring | Detecting exploit attempts depends on correlating logs, processes, and file activity. |
| RS.MA-01 — Response Plan Execution | Confirmed active exploitation requires containment and incident handling. | |
| Recommendation — Correlate web, host, and filesystem telemetry to confirm exploitation in progress. Execute containment playbooks immediately when exploit traffic produces host effects. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Log review is central to spotting exploit-shaped requests and timelines. |
| Recommendation — Preserve and review web and host logs around the first suspicious request. | ||
Practitioner Guidance
What to prioritise: Correlate the first suspicious request with process creation and file-system writes before you spend time on signature tuning. If the same source IP or request shape appears across multiple hosts, treat it as a campaign indicator and not an isolated probe.
What to verify: Confirm whether the affected app instance produced any outbound connections, temporary files, or spawned interpreters in the same window as the exploit-shaped request. That evidence is usually more decisive than the HTTP payload alone.
Decision rule: If you can tie a React-targeted request to command execution or a staged artefact on disk, escalate to incident response, isolate the host, and patch immediately rather than waiting for perfect certainty.
Practitioner takeaway: The key judgement is whether the request left host evidence. Once exploitation produces execution or writes, the problem is no longer just exposure, it is an active compromise path that needs containment first and remediation second.
Related resources from NHI Mgmt Group
- What signs indicate a WSUS exploitation attempt is under way?
- What are the signs that exploitation of a hardcoded credential vulnerability may already be under way?
- What are the signs that a file transfer vulnerability may already be under active exploitation?
- What are the signs that a gateway zero-day may already be under active exploitation?