CVE-2025-49704
published 2025-07-08CVE-2025-49704: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
PriorityP196high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2025-07-23
Exploited in the wild
EPSS
100.00%
100.0th percentile
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5508.1000 | 16.0.5508.1000 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10417.20027 | 16.0.10417.20027 |
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
Detection & IOCsextracted from sources · hover to see the quote
pathC:\Users\Administrator\Desktop\work\tools\ak47c2\dnsclinet-c\dnsclient\x64\Release\dnsclient.pdb↗
snort↗
SID 65092
snort↗
SID 65183
yara↗
Asp.Webshell.SharpyShell-10056352-3
- →Detect ToolShell exploitation by monitoring IIS logs for POST requests to the vulnerable ToolPane endpoint with a spoofed Referer header ↗
- →Use the Microsoft 365 Defender KQL query to detect creation of spinstall0.aspx in the SharePoint LAYOUTS directory ↗
- →The attacker sends a POST request to /_layouts/15/ToolPane.aspx?DisplayMode=Edit using a crafted Referer header (/_layouts/SignOut.aspx) to bypass authentication ↗
- →Monitor for w3wp.exe (SharePoint worker process) spawning child processes, especially encoded PowerShell, as a post-exploitation indicator ↗
- →Storm-2603 HTTP backdoor sends JSON beacons with fields cmd, cmd_id, fqdn, result, type to C2; detect Content-Type: text/plain POST requests with this JSON structure from SharePoint servers ↗
- →Detect ransomware ransom note filenames associated with Storm-2603: 'How to decrypt my data.log' (x2anylock/Warlock) and '.README.txt' (LockBit Black) ↗
- →Velociraptor version 0.73.4.0 (outdated, vulnerable to CVE-2025-6264) was installed on servers for persistence by Storm-2603; detect unexpected Velociraptor installations on servers ↗
- ·CVE-2025-49704 requires an authenticated attacker to extract the ValidationKey; the later bypass CVE-2025-53770 eliminates the authentication requirement, enabling unauthenticated RCE ↗
- ·These vulnerabilities affect only on-premises SharePoint Server deployments; SharePoint Online (Microsoft 365) is NOT impacted ↗
- ·In many reported cases it is unclear whether observed in-the-wild exploitation reflects abuse of the original CVEs (CVE-2025-49704/49706) or their bypasses (CVE-2025-53770/53771) ↗
- ·After patching, ASP.NET machine keys must be rotated (via Update-SPMachineKey PowerShell or Central Admin Machine Key Rotation Job) and IIS restarted, as stolen keys can still be used for forged ViewState RCE ↗
- ·Existing Snort SID 65092 (published for CVE-2025-49704 on July 8) was confirmed by Talos to remain effective against the newer bypass variants as well ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft SharePoint Improper Authentication Vulnerability
cisa·2025-07-22·CVSS 8.8
CVE-2025-49706 [HIGH] CWE-287 Microsoft SharePoint Improper Authentication Vulnerability
Vulnerability: Microsoft SharePoint Improper Authentication Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions
CISA
Microsoft SharePoint Code Injection Vulnerability
cisa·2025-07-22·CVSS 8.8
CVE-2025-49704 [HIGH] CWE-94 Microsoft SharePoint Code Injection Vulnerability
Vulnerability: Microsoft SharePoint Code Injection Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the a
CISA
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
cisa·2025-07-20·CVSS 8.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Vulnerability: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendo
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability
vendor_msrc·2025-07-08·CVSS 6.5
CVE-2025-53771 [HIGH] CWE-287 Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
Description: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
FAQ: Are the two new CVEs that were released related to the two SharePoint vulnerabilities that were documented by CVE-2025-49704 and CVE-2025-49706?
Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.
FAQ: There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on th
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability
vendor_msrc·2025-07-08·CVSS 9.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Description: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
FAQ: 7/20/2025 Update: Updates are now available for Microsoft SharePoint Server Subscription Edition and Microsoft SharePoint Server 2019.
Why are there no links to the update to protect from this vulnerability?
Microsoft is preparing and fully testing a comprehen
Microsoft
Microsoft SharePoint Remote Code Execution Vulnerability
vendor_msrc·2025-07-08·CVSS 8.8
CVE-2025-49704 [HIGH] CWE-94 Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft SharePoint Remote Code Execution Vulnerability
Description: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
FAQ: According to the CVSS metric, the attack vector is network (AV:N) and the attack complexity is low (AC:L). What does that mean for this vulnerability?
The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.
FAQ: According to the CVSS metric, privileges required is low (PR:L). What does that mean fo
GHSA
GHSA-mh5q-j7vq-g5g7: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
ghsa_unreviewed·2025-07-08
CVE-2025-49704 [HIGH] CWE-94 GHSA-mh5q-j7vq-g5g7: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
VulnCheck
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions
VulnCheck
Microsoft SharePoint Code Injection Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-49704 [HIGH] CWE-94 Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD
VulnCheck
Microsoft SharePoint Improper Authentication
vulncheck·2025·CVSS 6.5
CVE-2025-53771 [MEDIUM] Microsoft SharePoint Improper Authentication
Microsoft SharePoint Improper Authentication
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Affected: Microsoft SharePoint
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://research.eye.security/sharepoint-under-siege/; https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities; https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/; https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2
VulnCheck
Microsoft SharePoint Improper Authentication Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-49706 [HIGH] CWE-287 Microsoft SharePoint Improper Authentication Vulnerability
Microsoft SharePoint Improper Authentication Vulnerability
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follo
Tenable
CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
blogs_tenable·2026-07-16·CVSS 6.5
CVE-2026-32201 [MEDIUM] CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
## CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
Four Microsoft SharePoint Server vulnerabilities are under active exploitation, prompting CISA to issue a hardening alert. An additional high-severity flaw recently patched adds pressure for organizations running on-premises deployments.
## Key Takeaways
CISA confirmed active exploitation of three on-premises SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164), used to gain unauthorized access, establish remote code execution, steal IIS machine keys and deploy malware for persistence.
Two additional SharePoint Server vulnerabilities disclosed on July 14, 2026, CVE-2026-55040 and CVE-2026-58644, were not yet
Greynoiseio
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
blogs_greynoiseio·2026-02-02
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Checkpoint
Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
blogs_checkpoint·2025-12-16
CVE-2025-49706 Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
## Key Findings
In recent months, Check Point Research has identified a new wave of at
Tenable
Patch Tuesday 2025 Year In Review
blogs_tenable·2025-12-10
Patch Tuesday 2025 Year In Review
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Checkpoint
8th December – Threat Intelligence Report
blogs_checkpoint·2025-12-08
CVE-2025-55182 8th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 8th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous students, alumni, donors, staff, faculty, employees, and suppliers at Phoenix were impacted. The Cl0p ran
Securelist
Exploits and vulnerabilities in Q3 2025
blogs_securelist·2025-12-03·CVSS 7.8
CVE-2025-49704 [HIGH] Exploits and vulnerabilities in Q3 2025
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
Interesting vulnerabilities
ToolShell (CVE-2025-49704 and CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771): insecure deserialization and an authentication bypass
CVE-2025-8088: a directory traversal vulnerability in WinRAR
CVE-2025-41244: a privilege escalation vulnerability in VMware Aria Operations and VMware Tools
Conclusion and advice
Authors
Alexander Kolesnikov
In the third quarter, attackers continued to exploit security flaws in WinRAR, while the total number of registered vulnerabilities grew again. In this report, we examine statistics on published vuln
Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm
blogs_huntress·2025-12-03
Velociraptor Misuse, Pt. II: The Eye of the Storm
Acknowledgements: Special thanks to Ben Folland, Anna Pham, Michael Tigges, and Anton Ovrutsky for contributing to this investigation and writeup.
We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Velociraptor is a digital forensics and incident response (DFIR) tool that we have seen threat actors abuse recently in attacks in order to set up command-and-control (C2) communications.
Beyond this most recent incident, the Huntress SOC investigated and reported three incidents through September and November that involved the threat actor installing Velociraptor and using it for C2 of impacted endpoints. Some of the top takeaways from these
Securelist
Analyzing the vulnerability landscape in Q3 2025
blogs_securelist·2025-12-03
Analyzing the vulnerability landscape in Q3 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- C2 frameworks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
In the third quarter, attackers continued to exploit security flaws in WinRAR, while the total number of registered vulnerabilities grew again. In this report, we examine statistics on published vulnerabilities and exploits, the most common security issues impacting Windows and Linux, and the vulnerabilities being leveraged in APT attacks that lead to the launch of widespread C2 frameworks. The report utilizes anonymized Kaspersky Security Network data, which was consensually provided by our users, as well as information from open sources.
## Statistics on
Talos
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
blogs_talos·2025-10-23
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagements – a notable increase from less than 10 percent last quarter. This spike is largely attributable to a wave of engagements involving ToolShell, an attack chain that targets on-premises Microsoft SharePoint servers through exploitation of vulnerabilities that were publicly disclosed in July. We also saw an increase in post-exploitation phishing campaigns launched from compromised valid accounts this quarter, a trend we noted last quarter, with threat actors using this technique to expand their attack both within the compromised organizations as well as to external partner entities.
Watch this di
Talos
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
blogs_talos·2025-10-23
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
## IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagements – a notable increase from less than 10 percent last quarter. This spike is largely attributable to a wave of engagements involving ToolShell , an attack chain that targets on-premises Microsoft SharePoint servers through exploitation of vulnerabilities that were publicly disclosed in July. We also saw an increase in post-exploitation phishing campaigns launched from compromised valid accounts this quarter, a trend we noted last quarter, with threat actors using this technique to expan
Bleepingcomputer
Sharepoint ToolShell attacks targeted orgs across four continents
blogs_bleepingcomputer·2025-10-22·CVSS 8.8
CVE-2025-53770 [HIGH] Sharepoint ToolShell attacks targeted orgs across four continents
## Sharepoint ToolShell attacks targeted orgs across four continents
## Bill Toulas
Hackers believed to be associated with China have leveraged the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint in attacks targeting government agencies, universities, telecommunication service providers, and finance organizations.
The security flaw affects on-premise SharePoint servers and was disclosed as an actively exploited zero-day on July 20, after multiple hacking groups tied to China leveraged it in widespread attacks. Microsoft released emergency updates the following day.
The issue is a bypass for CVE-2025-49706 and CVE-2025-49704, two flaws that Viettel Cyber Security researchers had demonstrated at the Pwn2Own Berlin hacking competition in May, and can be leveraged remotely
Tenable
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
blogs_tenable·2025-08-08
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
blogs_unit42·2025-08-05·CVSS 8.8
CVE-2025-49704 [HIGH] Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
## Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
Hiroaki Hara
Mark Lim
Published: August 5, 2025
High Profile Threats
Threat Research
Vulnerabilities
Backdoor
CL-CRI-1040
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
LockBit
Microsoft
SharePoint
Storm-2603
## Executive Summary
Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.
Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis o
Unit42
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
blogs_unit42·2025-08-05
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
## Executive Summary
Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.
Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis of host- and network-based artifacts, we assess with high confidence that Storm-2603 is related to the activity cluster that we track as CL-CRI-1040. We initially noted this in our threat brief covering exploitation of recent SharePoint vulnerabilities, and here further expand on our observations. (See Table 1 in the
Bleepingcomputer
The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
blogs_bleepingcomputer·2025-08-05·CVSS 9.8
[CRITICAL] The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
## The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
## Picus Security
Summer 2025 wasn't just hot; it was relentless.
Ransomware hammered hospitals, retail giants suffered data breaches, insurance firms were hit by phishing, and nation-state actors launched disruptive campaigns.
From stealthy PowerShell loaders to zero-day SharePoint exploits, attackers kept defenders on their heels.
This report breaks down the season's most high-impact incidents and what security teams need to do before the next wave hits.
## Summer Expose Healthcare's Growing Ransomware Risk
Hospitals can't afford downtime, and attackers know it.
This summer, ransomware groups targeted healthcare, exploiting both the value of patient data and the urgency of care.
## Interlock rises as a major th
Bleepingcomputer
Ransomware gangs join attacks targeting Microsoft SharePoint servers
blogs_bleepingcomputer·2025-08-04·CVSS 8.8
[HIGH] Ransomware gangs join attacks targeting Microsoft SharePoint servers
## Ransomware gangs join attacks targeting Microsoft SharePoint servers
## Sergiu Gatlan
The loader was spotted following a failed exploitation attempt that revealed malicious PowerShell commands designed to disable security monitoring on the targeted device.
"Analysis of the 4L4MD4R payload revealed that it is UPX-packed and written in GoLang. Upon execution, the sample decrypts an AES-encrypted payload in memory, allocates memory to load the decrypted PE file, and creates a new thread to execute it," Unit 42 said .
The 4L4MD4R ransomware encrypts files on the compromised system and demands a payment of 0.005 Bitcoin, generating ransom notes and encrypted file lists on infected systems.
Microsoft and Google have also linked the ToolShell attacks to Chinese threat actors, with Micros
Checkpoint
Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
blogs_checkpoint·2025-07-31
CVE-2025-49704 Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
## Key Findings
Check Point Research (CPR) conducted a focused analysis of Storm-2603 , a threat actor associated
Unit42
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
blogs_unit42·2025-07-31·CVSS 8.8
CVE-2025-49704 [HIGH] Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
Threat Research Center
High Profile Threats
Vulnerabilities
## Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
Unit 42
Published: July 31, 2025
High Profile Threats
Vulnerabilities
CL-CRI-1040
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
Microsoft
SharePoint
Zero-day
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.
Update July 31, 2025
An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.
A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led
Unit42
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
blogs_unit42·2025-07-31·CVSS 8.8
CVE-2025-49704 [HIGH] Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.
Update July 31, 2025
An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.
A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led to the discovery of a loader designed to download and execute the ransomware from hxxps://ice.theinnovationfactory[.]it/static/4l4md4r.exe (145.239.97[.]206).
The PowerShell command attempted to disable real-time monitoring and bypass certificate validation. Full details are in the Scope of Attack section.
Update July 29, 2025
Unit 42 telemetr
Checkpoint
28th July – Threat Intelligence Report
blogs_checkpoint·2025-07-28·CVSS 9.8
CVE-2025-53770 [CRITICAL] 28th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 28th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The US Energy Department, including its National Nuclear Security Administration (NNSA), was reportedly breached as part of a Microsoft SharePoint vulnerability exploit. The breach was linked to a broader espionage campaign, that targeted government agencies via the CVE-2025-53770 The extent of the intrusion and data compromise
Securelist
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
blogs_securelist·2025-07-25·CVSS 7.8
CVE-2025-49706 [HIGH] ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Table of Contents
- The exploit
- CVE-2025-49706
- CVE-2025-53771
- CVE-2025-49704
- CVE-2025-53770
- CVE-2020-1147
- Conclusions
Authors
- Boris Larin
- Georgy Kucherin
- Ilya Savelyev
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously
Fortinet
Inside The ToolShell Campaign | FortiGuard Labs
blogs_fortinet·2025-07-25·CVSS 8.8
[HIGH] Inside The ToolShell Campaign | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Inside The ToolShell Campaign
New “ToolShell” Exploit Chain Targets Unpatched and Zero-Day SharePoint Vulnerabilities for Remote Code Execution
FORTIGUARD SECURITY PORTFOLIO 2025 THREAT LANDSCAPE REPORT
Probing Action
GhostWebShell
KeySiphon
Conclusion
Fortinet Protections
IOCs
By Cara Lin | July 25, 2025
Affected Platforms: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition
Impacted Users: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: Critical
FortiGuard Labs is currently tracking multiple threat actors targeting on-premises Microsoft SharePoint servers. This attack leverages a newly identified exploit chain dubbed "ToolS
Securelist
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
blogs_securelist·2025-07-25·CVSS 7.8
CVE-2025-49706 [HIGH] ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Table of Contents
The exploit
CVE-2025-49706
CVE-2025-53771
CVE-2025-49704
CVE-2025-53770
CVE-2020-1147
Conclusions
Authors
Boris Larin
Georgy Kucherin
Ilya Savelyev
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706 , publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771 , aimed at addressing the security bypasses of previously issued fix
Tenable
Cybersecurity Snapshot: SharePoint Attacks Trigger Urgent Patching Calls, While U.S. Gov’t Unveils AI Innovation Plan
blogs_tenable·2025-07-25
Cybersecurity Snapshot: SharePoint Attacks Trigger Urgent Patching Calls, While U.S. Gov’t Unveils AI Innovation Plan
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
blogs_bleepingcomputer·2025-07-24·CVSS 8.8
[HIGH] Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
## Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
## Sergiu Gatlan
"Starting on July 18, 2025, Microsoft has observed Storm-2603 deploying ransomware using these vulnerabilities."
After breaching the victims' networks, Storm-2603 operators use the Mimikatz hacking tool to extract plaintext credentials from LSASS memory.
They then move laterally with PsExec and the Impacket toolkit, executing commands via Windows Management Instrumentation (WMI), and modifying Group Policy Objects (GPOs) to deliver Warlock ransomware across compromised systems.
"Customers should apply the on-premises SharePoint Server security updates immediately and follow the detailed mitigation guidance in our blog," Microsoft also warned .
Microsoft Threat Intelligence researchers have also li
Bleepingcomputer
Microsoft links Sharepoint ToolShell attacks to Chinese hackers
blogs_bleepingcomputer·2025-07-22·CVSS 8.8
[HIGH] Microsoft links Sharepoint ToolShell attacks to Chinese hackers
## Microsoft links Sharepoint ToolShell attacks to Chinese hackers
## Sergiu Gatlan
"We assess that at least one of the actors responsible for this early exploitation is a China-nexus threat actor. It's critical to understand that multiple actors are now actively exploiting this vulnerability," Charles Carmakal, CTO of Google Cloud's Mandiant Consulting, told BleepingComputer yesterday.
On Friday, Dutch cybersecurity firm Eye Security first spotted zero-day attacks exploiting the CVE-2025-49706 and CVE-2025-49704 vulnerabilities (first demoed during the Berlin Pwn2Own hacking contest by Viettel Cyber Security researchers).
The company told BleepingComputer that at least 54 organizations had already been compromised, including several multinational companies and national government enti
Microsoft
Disrupting active exploitation of on-premises SharePoint vulnerabilities
blogs_microsoft·2025-07-22
Disrupting active exploitation of on-premises SharePoint vulnerabilities
Research
July 22, 2025
## Microsoft Sentinel
Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.
Our post on web shell threat hunting with Microsoft Sentinel also provides guidance on looking for web shells in general. Several hunting queries are also available below:
Web shell detection
Possible Webshell drop
Malicious web application requests linked with Microsoft Defender for Endpoint alerts
Web sh
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 8.8
CVE-2025-53770 [HIGH] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits & Vulnerabilities
# Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research
2025/07/22
Read time: ( words)
Save to Folio
Key takeaways
- CVE-2025-53770 and CVE-2025-53771 are vulnerabilities affecting on-premise Microsoft SharePoint Servers, which enables an attacker to upload malicious files and extract cryptographic secrets.
- These vulnerabilities are evolutions of previously patched flaws (CVE-2025-49704 and CVE-2025-49706), for which initial vendor-provided remediation was inc
Wiz
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
blogs_wiz·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.
# What are CVE-2025-53770 and CVE-2025-53771?
CVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.
CVE-2025-53771 (CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.
These vuln
Bleepingcomputer
Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
blogs_bleepingcomputer·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
## Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
## Lawrence Abrams
Using these flaws, the threat actors have been conducting ToolShell attacks on SharePoint servers worldwide , impacting over 54 organizations so far.
## Emergency updates released
Microsoft has now rushed out emergency out-of-band security updates for Microsoft SharePoint Subscription Edition, SharePoint 2019, and SharePoint 2016 that fix both the CVE-2025-53770 and CVE-2025-53771 flaws.
"Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706," reads a note in Microsoft advisories.
Microsoft SharePoint admins should install the followin
Talos
ToolShell: Details of CVEs affecting SharePoint servers
blogs_talos·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] ToolShell: Details of CVEs affecting SharePoint servers
## ToolShell: Details of CVEs affecting SharePoint servers
Update 2025/07/22: Microsoft has released a security update for Sharepoint Enterprise Server 2016. The update, with the ID KB5002760, is available in the following link .
Cisco Talos is aware of the ongoing exploitation of CVE-2025-53770 and CVE-2025-53771 in the wild. These are path traversal vulnerabilities affecting SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. According to Microsoft, these vulnerabilities do not affect SharePoint Online in Microsoft 365 and only apply to on-premises SharePoint servers.
Microsoft has also released security updates and mitigation guidance for multiple affected products. The update for Sharepoint Server 2016 has also been released .
These two vulne
Krebs
Microsoft Fix Targets Attacks on SharePoint Zero-Day
blogs_krebs·2025-07-21·CVSS 6.5
CVE-2025-53770 [MEDIUM] Microsoft Fix Targets Attacks on SharePoint Zero-Day
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch comes amid reports that malicious hackers have used the SharePoint flaw to breach U.S. federal and state agencies, universities, and energy companies.
In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770, Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, 2025 security update.
The Cybersecurity & Infrastructure Security Agency (CISA) concurred, saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier this month (CVE-2025-49706). Microsoft
Sentinelone
SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers
blogs_sentinelone·2025-07-21
SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers
On July 19th, Microsoft confirmed that a 0-day vulnerability impacting on-premises Microsoft SharePoint Servers, dubbed “ToolShell” (by researcher Khoa Dinh @_l0gg), was being actively exploited in the wild. This flaw has since been assigned the identifier CVE‑2025‑53770, along with an accompanying bypass tracked as CVE‑2025‑53771. These two new CVEs are being used alongside the previously patched CVEs (49704/49706) which were patched on July 8th, with PoC code surfacing by July 14th.
The advisory also confirmed emergency patches for on-prem SharePoint Subscription Edition and SharePoint Server 2019, with updates scheduled for version 2016 as well. We strongly recommend immediate patching, and following Microsoft’s recommendations of enabling AMSI detection, rotating ASP.NET machine keys,
Wiz
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
blogs_wiz·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.
## What are CVE-2025-53770 and CVE-2025-53771?
CVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.
CVE-2025-53771 (CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.
These vul
Qualys
ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities | Qualys
blogs_qualys·2025-07-21·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities | Qualys
#### Table of Contents
- CVE-2025-53770: Critical Remote Code Execution
- CVE-2025-53771: Server Spoofing Vulnerability
- History of the Vulnerabilities
- Who is Affected?
- Qualys QID Coverage
- Eliminating Risk of these Vulnerabilities with the Qualys Enterprise TruRiskTM Platform
On July 19, 2025, Microsoft issued an emergency out-of-band security update to address two zero-day vulnerabilities in Microsoft SharePoint Server: CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are under active exploitation in the wild and demand immediate attention to protect your on-premises SharePoint environments.
## CVE-2025-53770: Critical Remote Code Execution
The first of the two vulnerabilities, CVE-2025-53770, is a critical-severity vulnerability with a CVSS score of 9.8 out of 10. Succ
Zscaler
CVE-2025-53770 | ThreatLabz
blogs_zscaler·2025-07-21·CVSS 9.8
[CRITICAL] CVE-2025-53770 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Krebs
Microsoft Fix Targets Attacks on SharePoint Zero-Day
blogs_krebs·2025-07-21·CVSS 6.5
CVE-2025-53770 [MEDIUM] Microsoft Fix Targets Attacks on SharePoint Zero-Day
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch comes amid reports that malicious hackers have used the SharePoint flaw to breach U.S. federal and state agencies, universities, and energy companies.
Image: Shutterstock, by Ascannio.
In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770 , Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, 2025 security update .
The Cybersecurity & Infrastructure Security Agency (CISA) concurred , saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier t
Qualys
ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities
blogs_qualys·2025-07-21·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities
## Table of Contents
CVE-2025-53770: Critical Remote Code Execution
CVE-2025-53771: Server Spoofing Vulnerability
History of the Vulnerabilities
Who is Affected?
Qualys QID Coverage
Eliminating Risk of these Vulnerabilities with the Qualys Enterprise TruRiskTM Platform
On July 19, 2025, Microsoft issued an emergency out-of-band security update to address two zero-day vulnerabilities in Microsoft SharePoint Server: CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are under active exploitation in the wild and demand immediate attention to protect your on-premises SharePoint environments.
## CVE-2025-53770: Critical Remote Code Execution
The first of the two vulnerabilities, CVE-2025-53770, is a critical-severity vulnerability with a CVSS score of 9.8 out of 10. Successful ex
Talos
ToolShell: Details of CVEs affecting SharePoint servers
blogs_talos·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] ToolShell: Details of CVEs affecting SharePoint servers
Update 2025/07/22: Microsoft has released a security update for Sharepoint Enterprise Server 2016. The update, with the ID KB5002760, is available in the following link.
Cisco Talos is aware of the ongoing exploitation of CVE-2025-53770 and CVE-2025-53771 in the wild. These are path traversal vulnerabilities affecting SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. According to Microsoft, these vulnerabilities do not affect SharePoint Online in Microsoft 365 and only apply to on-premises SharePoint servers.
Microsoft has also released security updates and mitigation guidance for multiple affected products. The update for Sharepoint Server 2016 has also been released.
These two vulnerabilities, CVE-2025-53770 / CVE-2025-53771, are related to CV
Bleepingcomputer
Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
blogs_bleepingcomputer·2025-07-20·CVSS 8.8
CVE-2025-53770 [HIGH] Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
## Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
## Lawrence Abrams
While Microsoft patched both ToolShell flaws as part of the July Patch Tuesday , it is now warning that threat actors were able to bypass the fixes with new exploits.
These new vulnerabilities are tracked as CVE-2025-53770 (bypasses CVE-2025-49704) and CVE-2025-53771 (CVE-2025-49706), and are actively exploited attacks against on-premise SharePoint servers.
"Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update," warns a new Microsoft blog post .
"These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 is not impacted."
Microsoft has
Tenable
CVE-2025-53770: Frequently Asked Questions About Zero-Day SharePoint Vulnerability Exploitation
blogs_tenable·2025-07-20·CVSS 9.8
[CRITICAL] CVE-2025-53770: Frequently Asked Questions About Zero-Day SharePoint Vulnerability Exploitation
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Checkpoint
14th July – Threat Intelligence Report
blogs_checkpoint·2025-07-14
CVE-2025-49719 14th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 14th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 14th July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
McDonald’s has suffered a data breach that resulted in the exposure of chat transcripts, session tokens, and personal data from more than 64 million job applications submitted through its AI powered McHire chatbot platform. Data leaked included applicants’ names, email addresses, phone numbers, home addresses, availability, and
Qualys
Microsoft and Adobe Patch Tuesday, July 2025 Security Update Review | Qualys
blogs_qualys·2025-07-08
Microsoft and Adobe Patch Tuesday, July 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for July 2025
- Adobe Patches for July 2025
- Zero-day Vulnerability Patched in July Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in July Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Audit
- Microsoft July 2025 Patch Tuesday Mitigations
- Qualys Monthly Webinar Series
With cybersecurity threats continuing to evolve, Microsoft’s July 2025 Patch Tuesday highlights the need for consistent patching — this month’s release includes key fixes for actively exploited vulnerabilities. Here’s a
Talos
Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-07-08·CVSS 8.4
[HIGH] Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for July 2025, which includes 132 vulnerabilities affecting a range of products, including 14 that Microsoft marked as “critical.”
In this month's release, Microsoft observed none of the included vulnerabilities being actively exploited in the wild. Out of 14 "critical" entries, 11 are remote code execution (RCE) vulnerabilities in Microsoft Windows services and applications including KDC Proxy service, Microsoft Office and SharePoint server.
CVE-2025-49735 is an RCE vulnerability in Windows KDC Proxy Service (KPSSVC) given a CVSS 3.1 score of 8.1. To successfully exploit this vulnerability, an unauthenticated attacker could use a specially-crafted application to leverage a cryptographic protocol vulnerability in KPSSVC to perform RCE ag
Talos
Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-07-08·CVSS 8.4
[HIGH] Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for July 2025, which includes 132 vulnerabilities affecting a range of products, including 14 that Microsoft marked as “critical.”
In this month's release, Microsoft observed none of the included vulnerabilities being actively exploited in the wild. Out of 14 "critical" entries, 11 are remote code execution (RCE) vulnerabilities in Microsoft Windows services and applications including KDC Proxy service, Microsoft Office and SharePoint server.
CVE-2025-49735 is an RCE vulnerability in Windows KDC Proxy Service (KPSSVC) given a CVSS 3.1 score of 8.1. To successfully exploit this vulnerability, an unauthenticated attacker could use a specially-crafted appl
Tenable
Microsoft’s July 2025 Patch Tuesday Addresses 128 CVEs (CVE-2025-49719)
blogs_tenable·2025-07-08·CVSS 7.5
[HIGH] Microsoft’s July 2025 Patch Tuesday Addresses 128 CVEs (CVE-2025-49719)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft and Adobe Patch Tuesday, July 2025 Security Update Review
blogs_qualys·2025-07-08
Microsoft and Adobe Patch Tuesday, July 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for July 2025
Adobe Patches for July 2025
Zero-day Vulnerability Patched in July Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in July Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Audit
Microsoft July 2025 Patch Tuesday Mitigations
Qualys Monthly Webinar Series
With cybersecurity threats continuing to evolve, Microsoft’s July 2025 Patch Tuesday highlights the need for consistent patching — this month’s release includes key fixes for actively exploited vulnerabilities. Here’s a quick breakdo
Greynoiseio
NoiseLetter August 2025
blogs_greynoiseio
NoiseLetter August 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress
blogs_huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress
Acknowledgements: Special thanks to Ben Folland, Anna Pham, Michael Tigges, and Anton Ovrutsky for contributing to this investigation and writeup.
We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Velociraptor is a digital forensics and incident response (DFIR) tool that we have seen threat actors abuse recently in attacks in order to set up command-and-control (C2) communications.
Beyond this most recent incident, the Huntress SOC investigated and reported three incidents through September and November that involved the threat actor installing Velociraptor and using it for C2 of impacted endpoints. Some of the top takeaways from these
Recorded Future
ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
blogs_recorded_future·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
# ToolShell Exploit Chain Puts Thousands of SharePoint Servers at Risk
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 has not been impacted.
Read on to understand the ToolShell threat and how to defend against it with hunting packages, including Nuclei and YARA rules, from Recorded Future.
## The latest Tactics, Techniques, and Procedu
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·CVSS 8.8
CVE-2025-53770 [HIGH] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
# Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro
September 22, 2025
Read time: ( words)
Save to Folio
Key takeaways
- CVE-2025-53770 and CVE-2025-53771 are vulnerabilities affecting on-premise Microsoft SharePoint Servers, which enables an attacker to upload malicious files and extract cryptographic secrets.
- These vulnerabilities are evolutions of previously patched flaws (CVE-2025-49704 and CVE-2025-49706), for which initial vendor-provided remediation was incomplete, enabling attackers to achieve
Recorded Future
ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
blogs_recorded_future·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 has not been impacted.
Read on to understand the ToolShell threat and how to defend against it with hunting packages, including Nuclei and YARA rules, from Recorded Future.
## The latest Tactics, Techniques, and Procedures (TTPs)
On July 23, 2025, researchers at LeakIX shared details that
Crowdstrike
July 2025 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] July 2025 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
ATT&CK
SharePoint ToolShell Exploitation
mitre_attack·CVSS 8.8
CVE-2025-49706 [HIGH] SharePoint ToolShell Exploitation
SharePoint ToolShell Exploitation
The [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors [Threat Group-3390](https://attack.mitre.org/groups/G0027) and [ZIRCONIUM](https://attack.mitre.org/groups/G0128). [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) targeted multiple regions and industries including
2025-07-08
Published
2025-07-22
Added to CISA KEV
Exploited in the wild