CVE-2025-49706
published 2025-07-08CVE-2025-49706: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
PriorityP188medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2025-07-23
Exploited in the wild
EPSS
99.88%
100.0th percentile
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5508.1000 | 16.0.5508.1000 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10417.20027 | 16.0.10417.20027 |
| microsoft | microsoft_sharepoint_server_subscription_edition | >= 16.0.0 < 16.0.18526.20424 | 16.0.18526.20424 |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft | sharepoint_server | < 16.0.18526.20424 | 16.0.18526.20424 |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
Detection & IOCsextracted from sources · hover to see the quote
pathC:\Users\Administrator\Desktop\work\tools\ak47c2\dnsclinet-c\dnsclient\x64\Release\dnsclient.pdb↗
snort↗
SID 65092
snort↗
SID 65183
yara↗
Asp.Webshell.SharpyShell-10056352-3
sigma↗
DeviceFileEvents | where FolderPath has "MICROS~1\\WEBSER~1\\16\\TEMPLATE\\LAYOUTS" | where FileName =~ "spinstall0.aspx" or FileName has "spinstall0" | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ReportId, ActionType, SHA256 | order by Timestamp desc
- →Detect ToolShell exploitation by monitoring IIS logs for POST requests to _layouts/15/ToolPane.aspx?DisplayMode=Edit with a Referer header of _layouts/SignOut.aspx — this is the authentication bypass pattern (CVE-2025-53771 / CVE-2025-49706). ↗
- →Alert on creation of spinstall0.aspx (or any file matching 'spinstall0') under the SharePoint LAYOUTS directory as an indicator of web shell deployment. ↗
- →Monitor for w3wp.exe (SharePoint IIS worker process) spawning encoded PowerShell child processes as a post-exploitation indicator. ↗
- →Storm-2603's AK47HTTP backdoor sends JSON beacons with fields cmd, cmd_id, fqdn, result, type over HTTP with Content-Type: text/plain and Accept: */*; hunt for this unusual Content-Type in outbound HTTP from SharePoint servers. ↗
- →Ransomware deployed by Storm-2603 uses DLL hijacking via legitimate binaries (MpCmdRun.exe, clink_x86.exe, VMToolsEng.exe); monitor for these processes loading unexpected DLLs. ↗
- →Velociraptor version 0.73.4.0 (outdated, vulnerable to CVE-2025-6264) was installed on compromised servers for persistence by Storm-2603; detect unexpected Velociraptor installations on SharePoint or database servers. ↗
- →The ToolShell exploit uses malicious __VIEWSTATE payloads signed with stolen ValidationKey/DecryptionKey from machineKey config; monitor for deserialization errors or anomalous ViewState sizes on SharePoint endpoints. ↗
- ·CVE-2025-49706 (spoofing) is the original vulnerability; CVE-2025-53771 is a bypass of its patch. In many reported cases it is unclear whether observed exploitation reflects the original CVE or its bypass variant. ↗
- ·These vulnerabilities affect on-premises SharePoint Server only (Subscription Edition, 2019, 2016, and EOL 2010/2013); SharePoint Online in Microsoft 365 is NOT impacted. ↗
- ·Existing Snort SID 65092 (published for CVE-2025-49704) has been confirmed by Talos to remain effective against the newer bypass variants CVE-2025-53770/53771 as well. ↗
- ·Patching alone is insufficient; Microsoft requires rotation of ASP.NET machine keys (ValidationKey/DecryptionKey) post-patch, as stolen keys can still be used for RCE even on patched servers. ↗
- ·Self-managed SharePoint Server instances hosted in cloud environments (Azure, AWS, GCP) are vulnerable; only SharePoint Online (Microsoft 365) is unaffected. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft SharePoint Improper Authentication Vulnerability
cisa·2025-07-22·CVSS 8.8
CVE-2025-49706 [HIGH] CWE-287 Microsoft SharePoint Improper Authentication Vulnerability
Vulnerability: Microsoft SharePoint Improper Authentication Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions
CISA
Microsoft SharePoint Code Injection Vulnerability
cisa·2025-07-22·CVSS 8.8
CVE-2025-49704 [HIGH] CWE-94 Microsoft SharePoint Code Injection Vulnerability
Vulnerability: Microsoft SharePoint Code Injection Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the a
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability
vendor_msrc·2025-07-08·CVSS 6.5
CVE-2025-53771 [HIGH] CWE-287 Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
Description: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
FAQ: Are the two new CVEs that were released related to the two SharePoint vulnerabilities that were documented by CVE-2025-49704 and CVE-2025-49706?
Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.
FAQ: There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on th
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability
vendor_msrc·2025-07-08·CVSS 9.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Description: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
FAQ: 7/20/2025 Update: Updates are now available for Microsoft SharePoint Server Subscription Edition and Microsoft SharePoint Server 2019.
Why are there no links to the update to protect from this vulnerability?
Microsoft is preparing and fully testing a comprehen
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability
vendor_msrc·2025-07-08·CVSS 6.5
CVE-2025-49706 [MEDIUM] CWE-287 Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
Description: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
FAQ: According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and some loss of integrity (I:L), but no loss of availability (A:N). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could view sensitive information, a token in this scenario (Confidentiality), and make some changes to disclosed information (Integrity), but they would not be able to affect Availability.
FAQ: I am running SharePoint Server 2016. Do the updates for SharePoint Enterprise Server 2016 also apply to the vers
GHSA
GHSA-j67g-r75f-8hgp: Improper authentication in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network
ghsa_unreviewed·2025-07-08
CVE-2025-49706 [MEDIUM] CWE-287 GHSA-j67g-r75f-8hgp: Improper authentication in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network
Improper authentication in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
VulnCheck
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions
VulnCheck
Microsoft SharePoint Code Injection Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-49704 [HIGH] CWE-94 Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD
VulnCheck
Microsoft SharePoint Improper Authentication
vulncheck·2025·CVSS 6.5
CVE-2025-53771 [MEDIUM] Microsoft SharePoint Improper Authentication
Microsoft SharePoint Improper Authentication
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Affected: Microsoft SharePoint
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://research.eye.security/sharepoint-under-siege/; https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities; https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/; https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2
VulnCheck
Microsoft SharePoint Improper Authentication Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-49706 [HIGH] CWE-287 Microsoft SharePoint Improper Authentication Vulnerability
Microsoft SharePoint Improper Authentication Vulnerability
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follo
Suricata
ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706)
suricata·2025-07-08·CVSS 6.5
CVE-2025-49706 [MEDIUM] ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706)
ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"|2f|toolpane.aspx|3f|"; fast_pattern; nocase; content:"displaymode|3d|edit"; nocase; content:"|2f|toolpane.aspx"; endswith; nocase; http.referer; content:"|2f|signout.aspx"; nocase; http.request_body; content:"msotlpn_uri|3d|"; nocase; pcre:"/^.*?(?:\x252[fF]|\x2f)_controltemplates(?:\x252[fF]|\x2f).*?(?:\x252[eE]|\x2e)ascx(?:\x26|$)/R"; content:"msotlpn_dwp|3d|"; nocase; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706; reference:cve,2025-49706; classtype:attempted-user; sid:206364
Sigma
Suspicious File Write to SharePoint Layouts Directory
sigma·CVSS 8.8
CVE-2025-49704 [HIGH] Suspicious File Write to SharePoint Layouts Directory
Suspicious File Write to SharePoint Layouts Directory
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Detection:
condition: selection
selection:
Image|endswith:
- \cmd.exe
- \powershell_ise.exe
- \powershell.exe
- \pwsh.exe
- \w3wp.exe
TargetFilename|contains:
- \15\TEMPLATE\LAYOUTS\
- \16\TEMPLATE\LAYOUTS\
TargetFilename|endswith:
- .asax
- .ascx
- .ashx
- .asmx
- .asp
- .aspx
- .bat
- .cmd
- .cer
- .config
- .hta
- .js
- .jsp
- .jspx
- .php
- .ps1
- .vbs
TargetFilename|startswith:
- C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\
- C:\Program Files (x
Nuclei
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
nuclei·CVSS 6.5
CVE-2025-53771 [MEDIUM] Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /_layouts/15/ToolPane.aspx with a forged Referer header (/_layouts/SignOut.aspx), attackers can bypass authentication mechanisms and gain unauthorized access to protected endpoints. This vulnerability is part of the ToolShell exploit chain and is a patch bypass for CVE-2025-49706. When chained with CVE-2025-53770 (deserialization vulnerability), it enables unauthenticated remote code execution on SharePoint Server.
Template:
id: CVE-2025-53771
info:
name: Microsoft SharePoint Server - Authentication Bypass (ToolShell)
author: _l0gg,SamIntru
Nuclei
Microsoft SharePoint Server - Authentication Bypass
nuclei·CVSS 6.5
CVE-2025-49706 [MEDIUM] Microsoft SharePoint Server - Authentication Bypass
Microsoft SharePoint Server - Authentication Bypass
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Template:
id: CVE-2025-49706
info:
name: Microsoft SharePoint Server - Authentication Bypass
author: daffainfo
severity: medium
description: |
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
impact: |
Unauthenticated attackers can spoof authentication by manipulating the Referer header to access ToolPane functionality, potentially enabling unauthorized actions on SharePoint sites.
remediation: |
Apply the Microsoft security patches for SharePoint Server as described in the MSRC update guide.
reference:
- https://msrc.microsoft.com/update-gu
Metasploit
Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
metasploit·CVSS 8.8
CVE-2025-49706 [HIGH] Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704, and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path. As this exploit module does not target the endpoint associated with CVE-2025-53770 (per the original finders), we believe this module is best described as exploiting CVE-2025-49704 and not CVE-2025-53770.
Tenable
CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
blogs_tenable·2026-07-16·CVSS 6.5
CVE-2026-32201 [MEDIUM] CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
## CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
Four Microsoft SharePoint Server vulnerabilities are under active exploitation, prompting CISA to issue a hardening alert. An additional high-severity flaw recently patched adds pressure for organizations running on-premises deployments.
## Key Takeaways
CISA confirmed active exploitation of three on-premises SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164), used to gain unauthorized access, establish remote code execution, steal IIS machine keys and deploy malware for persistence.
Two additional SharePoint Server vulnerabilities disclosed on July 14, 2026, CVE-2026-55040 and CVE-2026-58644, were not yet
Greynoiseio
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
blogs_greynoiseio·2026-02-02
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Checkpoint
Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
blogs_checkpoint·2025-12-16
CVE-2025-49706 Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
## Key Findings
In recent months, Check Point Research has identified a new wave of at
Tenable
Patch Tuesday 2025 Year In Review
blogs_tenable·2025-12-10
Patch Tuesday 2025 Year In Review
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Checkpoint
8th December – Threat Intelligence Report
blogs_checkpoint·2025-12-08
CVE-2025-55182 8th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 8th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous students, alumni, donors, staff, faculty, employees, and suppliers at Phoenix were impacted. The Cl0p ran
Securelist
Exploits and vulnerabilities in Q3 2025
blogs_securelist·2025-12-03·CVSS 7.8
CVE-2025-49704 [HIGH] Exploits and vulnerabilities in Q3 2025
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
Interesting vulnerabilities
ToolShell (CVE-2025-49704 and CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771): insecure deserialization and an authentication bypass
CVE-2025-8088: a directory traversal vulnerability in WinRAR
CVE-2025-41244: a privilege escalation vulnerability in VMware Aria Operations and VMware Tools
Conclusion and advice
Authors
Alexander Kolesnikov
In the third quarter, attackers continued to exploit security flaws in WinRAR, while the total number of registered vulnerabilities grew again. In this report, we examine statistics on published vuln
Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm
blogs_huntress·2025-12-03
Velociraptor Misuse, Pt. II: The Eye of the Storm
Acknowledgements: Special thanks to Ben Folland, Anna Pham, Michael Tigges, and Anton Ovrutsky for contributing to this investigation and writeup.
We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Velociraptor is a digital forensics and incident response (DFIR) tool that we have seen threat actors abuse recently in attacks in order to set up command-and-control (C2) communications.
Beyond this most recent incident, the Huntress SOC investigated and reported three incidents through September and November that involved the threat actor installing Velociraptor and using it for C2 of impacted endpoints. Some of the top takeaways from these
Securelist
Analyzing the vulnerability landscape in Q3 2025
blogs_securelist·2025-12-03
Analyzing the vulnerability landscape in Q3 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- C2 frameworks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
In the third quarter, attackers continued to exploit security flaws in WinRAR, while the total number of registered vulnerabilities grew again. In this report, we examine statistics on published vulnerabilities and exploits, the most common security issues impacting Windows and Linux, and the vulnerabilities being leveraged in APT attacks that lead to the launch of widespread C2 frameworks. The report utilizes anonymized Kaspersky Security Network data, which was consensually provided by our users, as well as information from open sources.
## Statistics on
Talos
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
blogs_talos·2025-10-23
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagements – a notable increase from less than 10 percent last quarter. This spike is largely attributable to a wave of engagements involving ToolShell, an attack chain that targets on-premises Microsoft SharePoint servers through exploitation of vulnerabilities that were publicly disclosed in July. We also saw an increase in post-exploitation phishing campaigns launched from compromised valid accounts this quarter, a trend we noted last quarter, with threat actors using this technique to expand their attack both within the compromised organizations as well as to external partner entities.
Watch this di
Talos
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
blogs_talos·2025-10-23
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
## IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagements – a notable increase from less than 10 percent last quarter. This spike is largely attributable to a wave of engagements involving ToolShell , an attack chain that targets on-premises Microsoft SharePoint servers through exploitation of vulnerabilities that were publicly disclosed in July. We also saw an increase in post-exploitation phishing campaigns launched from compromised valid accounts this quarter, a trend we noted last quarter, with threat actors using this technique to expan
Bleepingcomputer
Sharepoint ToolShell attacks targeted orgs across four continents
blogs_bleepingcomputer·2025-10-22·CVSS 8.8
CVE-2025-53770 [HIGH] Sharepoint ToolShell attacks targeted orgs across four continents
## Sharepoint ToolShell attacks targeted orgs across four continents
## Bill Toulas
Hackers believed to be associated with China have leveraged the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint in attacks targeting government agencies, universities, telecommunication service providers, and finance organizations.
The security flaw affects on-premise SharePoint servers and was disclosed as an actively exploited zero-day on July 20, after multiple hacking groups tied to China leveraged it in widespread attacks. Microsoft released emergency updates the following day.
The issue is a bypass for CVE-2025-49706 and CVE-2025-49704, two flaws that Viettel Cyber Security researchers had demonstrated at the Pwn2Own Berlin hacking competition in May, and can be leveraged remotely
Tenable
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
blogs_tenable·2025-08-08
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
blogs_unit42·2025-08-05·CVSS 8.8
CVE-2025-49704 [HIGH] Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
## Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
Hiroaki Hara
Mark Lim
Published: August 5, 2025
High Profile Threats
Threat Research
Vulnerabilities
Backdoor
CL-CRI-1040
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
LockBit
Microsoft
SharePoint
Storm-2603
## Executive Summary
Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.
Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis o
Unit42
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
blogs_unit42·2025-08-05
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
## Executive Summary
Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.
Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis of host- and network-based artifacts, we assess with high confidence that Storm-2603 is related to the activity cluster that we track as CL-CRI-1040. We initially noted this in our threat brief covering exploitation of recent SharePoint vulnerabilities, and here further expand on our observations. (See Table 1 in the
Bleepingcomputer
The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
blogs_bleepingcomputer·2025-08-05·CVSS 9.8
[CRITICAL] The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
## The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
## Picus Security
Summer 2025 wasn't just hot; it was relentless.
Ransomware hammered hospitals, retail giants suffered data breaches, insurance firms were hit by phishing, and nation-state actors launched disruptive campaigns.
From stealthy PowerShell loaders to zero-day SharePoint exploits, attackers kept defenders on their heels.
This report breaks down the season's most high-impact incidents and what security teams need to do before the next wave hits.
## Summer Expose Healthcare's Growing Ransomware Risk
Hospitals can't afford downtime, and attackers know it.
This summer, ransomware groups targeted healthcare, exploiting both the value of patient data and the urgency of care.
## Interlock rises as a major th
Bleepingcomputer
Ransomware gangs join attacks targeting Microsoft SharePoint servers
blogs_bleepingcomputer·2025-08-04·CVSS 8.8
[HIGH] Ransomware gangs join attacks targeting Microsoft SharePoint servers
## Ransomware gangs join attacks targeting Microsoft SharePoint servers
## Sergiu Gatlan
The loader was spotted following a failed exploitation attempt that revealed malicious PowerShell commands designed to disable security monitoring on the targeted device.
"Analysis of the 4L4MD4R payload revealed that it is UPX-packed and written in GoLang. Upon execution, the sample decrypts an AES-encrypted payload in memory, allocates memory to load the decrypted PE file, and creates a new thread to execute it," Unit 42 said .
The 4L4MD4R ransomware encrypts files on the compromised system and demands a payment of 0.005 Bitcoin, generating ransom notes and encrypted file lists on infected systems.
Microsoft and Google have also linked the ToolShell attacks to Chinese threat actors, with Micros
Checkpoint
Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
blogs_checkpoint·2025-07-31
CVE-2025-49704 Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
## Key Findings
Check Point Research (CPR) conducted a focused analysis of Storm-2603 , a threat actor associated
Unit42
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
blogs_unit42·2025-07-31·CVSS 8.8
CVE-2025-49704 [HIGH] Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
Threat Research Center
High Profile Threats
Vulnerabilities
## Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
Unit 42
Published: July 31, 2025
High Profile Threats
Vulnerabilities
CL-CRI-1040
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
Microsoft
SharePoint
Zero-day
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.
Update July 31, 2025
An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.
A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led
Unit42
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
blogs_unit42·2025-07-31·CVSS 8.8
CVE-2025-49704 [HIGH] Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.
Update July 31, 2025
An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.
A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led to the discovery of a loader designed to download and execute the ransomware from hxxps://ice.theinnovationfactory[.]it/static/4l4md4r.exe (145.239.97[.]206).
The PowerShell command attempted to disable real-time monitoring and bypass certificate validation. Full details are in the Scope of Attack section.
Update July 29, 2025
Unit 42 telemetr
Checkpoint
28th July – Threat Intelligence Report
blogs_checkpoint·2025-07-28·CVSS 9.8
CVE-2025-53770 [CRITICAL] 28th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 28th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The US Energy Department, including its National Nuclear Security Administration (NNSA), was reportedly breached as part of a Microsoft SharePoint vulnerability exploit. The breach was linked to a broader espionage campaign, that targeted government agencies via the CVE-2025-53770 The extent of the intrusion and data compromise
Securelist
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
blogs_securelist·2025-07-25·CVSS 7.8
CVE-2025-49706 [HIGH] ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Table of Contents
- The exploit
- CVE-2025-49706
- CVE-2025-53771
- CVE-2025-49704
- CVE-2025-53770
- CVE-2020-1147
- Conclusions
Authors
- Boris Larin
- Georgy Kucherin
- Ilya Savelyev
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously
Fortinet
Inside The ToolShell Campaign | FortiGuard Labs
blogs_fortinet·2025-07-25·CVSS 8.8
[HIGH] Inside The ToolShell Campaign | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Inside The ToolShell Campaign
New “ToolShell” Exploit Chain Targets Unpatched and Zero-Day SharePoint Vulnerabilities for Remote Code Execution
FORTIGUARD SECURITY PORTFOLIO 2025 THREAT LANDSCAPE REPORT
Probing Action
GhostWebShell
KeySiphon
Conclusion
Fortinet Protections
IOCs
By Cara Lin | July 25, 2025
Affected Platforms: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition
Impacted Users: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: Critical
FortiGuard Labs is currently tracking multiple threat actors targeting on-premises Microsoft SharePoint servers. This attack leverages a newly identified exploit chain dubbed "ToolS
Securelist
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
blogs_securelist·2025-07-25·CVSS 7.8
CVE-2025-49706 [HIGH] ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Table of Contents
The exploit
CVE-2025-49706
CVE-2025-53771
CVE-2025-49704
CVE-2025-53770
CVE-2020-1147
Conclusions
Authors
Boris Larin
Georgy Kucherin
Ilya Savelyev
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706 , publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771 , aimed at addressing the security bypasses of previously issued fix
Tenable
Cybersecurity Snapshot: SharePoint Attacks Trigger Urgent Patching Calls, While U.S. Gov’t Unveils AI Innovation Plan
blogs_tenable·2025-07-25
Cybersecurity Snapshot: SharePoint Attacks Trigger Urgent Patching Calls, While U.S. Gov’t Unveils AI Innovation Plan
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
blogs_bleepingcomputer·2025-07-24·CVSS 8.8
[HIGH] Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
## Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
## Sergiu Gatlan
"Starting on July 18, 2025, Microsoft has observed Storm-2603 deploying ransomware using these vulnerabilities."
After breaching the victims' networks, Storm-2603 operators use the Mimikatz hacking tool to extract plaintext credentials from LSASS memory.
They then move laterally with PsExec and the Impacket toolkit, executing commands via Windows Management Instrumentation (WMI), and modifying Group Policy Objects (GPOs) to deliver Warlock ransomware across compromised systems.
"Customers should apply the on-premises SharePoint Server security updates immediately and follow the detailed mitigation guidance in our blog," Microsoft also warned .
Microsoft Threat Intelligence researchers have also li
Bleepingcomputer
Microsoft links Sharepoint ToolShell attacks to Chinese hackers
blogs_bleepingcomputer·2025-07-22·CVSS 8.8
[HIGH] Microsoft links Sharepoint ToolShell attacks to Chinese hackers
## Microsoft links Sharepoint ToolShell attacks to Chinese hackers
## Sergiu Gatlan
"We assess that at least one of the actors responsible for this early exploitation is a China-nexus threat actor. It's critical to understand that multiple actors are now actively exploiting this vulnerability," Charles Carmakal, CTO of Google Cloud's Mandiant Consulting, told BleepingComputer yesterday.
On Friday, Dutch cybersecurity firm Eye Security first spotted zero-day attacks exploiting the CVE-2025-49706 and CVE-2025-49704 vulnerabilities (first demoed during the Berlin Pwn2Own hacking contest by Viettel Cyber Security researchers).
The company told BleepingComputer that at least 54 organizations had already been compromised, including several multinational companies and national government enti
Microsoft
Disrupting active exploitation of on-premises SharePoint vulnerabilities
blogs_microsoft·2025-07-22
Disrupting active exploitation of on-premises SharePoint vulnerabilities
Research
July 22, 2025
## Microsoft Sentinel
Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.
Our post on web shell threat hunting with Microsoft Sentinel also provides guidance on looking for web shells in general. Several hunting queries are also available below:
Web shell detection
Possible Webshell drop
Malicious web application requests linked with Microsoft Defender for Endpoint alerts
Web sh
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 8.8
CVE-2025-53770 [HIGH] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits & Vulnerabilities
# Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research
2025/07/22
Read time: ( words)
Save to Folio
Key takeaways
- CVE-2025-53770 and CVE-2025-53771 are vulnerabilities affecting on-premise Microsoft SharePoint Servers, which enables an attacker to upload malicious files and extract cryptographic secrets.
- These vulnerabilities are evolutions of previously patched flaws (CVE-2025-49704 and CVE-2025-49706), for which initial vendor-provided remediation was inc
Wiz
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
blogs_wiz·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.
# What are CVE-2025-53770 and CVE-2025-53771?
CVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.
CVE-2025-53771 (CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.
These vuln
Bleepingcomputer
Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
blogs_bleepingcomputer·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
## Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
## Lawrence Abrams
Using these flaws, the threat actors have been conducting ToolShell attacks on SharePoint servers worldwide , impacting over 54 organizations so far.
## Emergency updates released
Microsoft has now rushed out emergency out-of-band security updates for Microsoft SharePoint Subscription Edition, SharePoint 2019, and SharePoint 2016 that fix both the CVE-2025-53770 and CVE-2025-53771 flaws.
"Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706," reads a note in Microsoft advisories.
Microsoft SharePoint admins should install the followin
Talos
ToolShell: Details of CVEs affecting SharePoint servers
blogs_talos·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] ToolShell: Details of CVEs affecting SharePoint servers
## ToolShell: Details of CVEs affecting SharePoint servers
Update 2025/07/22: Microsoft has released a security update for Sharepoint Enterprise Server 2016. The update, with the ID KB5002760, is available in the following link .
Cisco Talos is aware of the ongoing exploitation of CVE-2025-53770 and CVE-2025-53771 in the wild. These are path traversal vulnerabilities affecting SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. According to Microsoft, these vulnerabilities do not affect SharePoint Online in Microsoft 365 and only apply to on-premises SharePoint servers.
Microsoft has also released security updates and mitigation guidance for multiple affected products. The update for Sharepoint Server 2016 has also been released .
These two vulne
Krebs
Microsoft Fix Targets Attacks on SharePoint Zero-Day
blogs_krebs·2025-07-21·CVSS 6.5
CVE-2025-53770 [MEDIUM] Microsoft Fix Targets Attacks on SharePoint Zero-Day
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch comes amid reports that malicious hackers have used the SharePoint flaw to breach U.S. federal and state agencies, universities, and energy companies.
In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770, Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, 2025 security update.
The Cybersecurity & Infrastructure Security Agency (CISA) concurred, saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier this month (CVE-2025-49706). Microsoft
Wiz
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
blogs_wiz·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.
## What are CVE-2025-53770 and CVE-2025-53771?
CVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.
CVE-2025-53771 (CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.
These vul
Qualys
ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities | Qualys
blogs_qualys·2025-07-21·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities | Qualys
#### Table of Contents
- CVE-2025-53770: Critical Remote Code Execution
- CVE-2025-53771: Server Spoofing Vulnerability
- History of the Vulnerabilities
- Who is Affected?
- Qualys QID Coverage
- Eliminating Risk of these Vulnerabilities with the Qualys Enterprise TruRiskTM Platform
On July 19, 2025, Microsoft issued an emergency out-of-band security update to address two zero-day vulnerabilities in Microsoft SharePoint Server: CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are under active exploitation in the wild and demand immediate attention to protect your on-premises SharePoint environments.
## CVE-2025-53770: Critical Remote Code Execution
The first of the two vulnerabilities, CVE-2025-53770, is a critical-severity vulnerability with a CVSS score of 9.8 out of 10. Succ
Krebs
Microsoft Fix Targets Attacks on SharePoint Zero-Day
blogs_krebs·2025-07-21·CVSS 6.5
CVE-2025-53770 [MEDIUM] Microsoft Fix Targets Attacks on SharePoint Zero-Day
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch comes amid reports that malicious hackers have used the SharePoint flaw to breach U.S. federal and state agencies, universities, and energy companies.
Image: Shutterstock, by Ascannio.
In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770 , Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, 2025 security update .
The Cybersecurity & Infrastructure Security Agency (CISA) concurred , saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier t
Qualys
ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities
blogs_qualys·2025-07-21·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities
## Table of Contents
CVE-2025-53770: Critical Remote Code Execution
CVE-2025-53771: Server Spoofing Vulnerability
History of the Vulnerabilities
Who is Affected?
Qualys QID Coverage
Eliminating Risk of these Vulnerabilities with the Qualys Enterprise TruRiskTM Platform
On July 19, 2025, Microsoft issued an emergency out-of-band security update to address two zero-day vulnerabilities in Microsoft SharePoint Server: CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are under active exploitation in the wild and demand immediate attention to protect your on-premises SharePoint environments.
## CVE-2025-53770: Critical Remote Code Execution
The first of the two vulnerabilities, CVE-2025-53770, is a critical-severity vulnerability with a CVSS score of 9.8 out of 10. Successful ex
Talos
ToolShell: Details of CVEs affecting SharePoint servers
blogs_talos·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] ToolShell: Details of CVEs affecting SharePoint servers
Update 2025/07/22: Microsoft has released a security update for Sharepoint Enterprise Server 2016. The update, with the ID KB5002760, is available in the following link.
Cisco Talos is aware of the ongoing exploitation of CVE-2025-53770 and CVE-2025-53771 in the wild. These are path traversal vulnerabilities affecting SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. According to Microsoft, these vulnerabilities do not affect SharePoint Online in Microsoft 365 and only apply to on-premises SharePoint servers.
Microsoft has also released security updates and mitigation guidance for multiple affected products. The update for Sharepoint Server 2016 has also been released.
These two vulnerabilities, CVE-2025-53770 / CVE-2025-53771, are related to CV
Checkpoint
21st July – Threat Intelligence Report
blogs_checkpoint·2025-07-21
CVE-2025-53770 21st July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 21st July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 21st July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Luxury retailer Louis Vuitton has suffered a cyber-attack that resulted in the exfiltration of certain personal data of customers from the UK, South Korea, Turkey , Italy, and Sweden after unauthorized access to its systems. No payment information was compromised, but sensitive client data was exposed, reportedly due to a breac
Bleepingcomputer
Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
blogs_bleepingcomputer·2025-07-20·CVSS 8.8
CVE-2025-53770 [HIGH] Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
## Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
## Lawrence Abrams
While Microsoft patched both ToolShell flaws as part of the July Patch Tuesday , it is now warning that threat actors were able to bypass the fixes with new exploits.
These new vulnerabilities are tracked as CVE-2025-53770 (bypasses CVE-2025-49704) and CVE-2025-53771 (CVE-2025-49706), and are actively exploited attacks against on-premise SharePoint servers.
"Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update," warns a new Microsoft blog post .
"These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 is not impacted."
Microsoft has
Tenable
CVE-2025-53770: Frequently Asked Questions About Zero-Day SharePoint Vulnerability Exploitation
blogs_tenable·2025-07-20·CVSS 9.8
[CRITICAL] CVE-2025-53770: Frequently Asked Questions About Zero-Day SharePoint Vulnerability Exploitation
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Microsoft’s July 2025 Patch Tuesday Addresses 128 CVEs (CVE-2025-49719)
blogs_tenable·2025-07-08·CVSS 7.5
[HIGH] Microsoft’s July 2025 Patch Tuesday Addresses 128 CVEs (CVE-2025-49719)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress
blogs_huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress
Acknowledgements: Special thanks to Ben Folland, Anna Pham, Michael Tigges, and Anton Ovrutsky for contributing to this investigation and writeup.
We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Velociraptor is a digital forensics and incident response (DFIR) tool that we have seen threat actors abuse recently in attacks in order to set up command-and-control (C2) communications.
Beyond this most recent incident, the Huntress SOC investigated and reported three incidents through September and November that involved the threat actor installing Velociraptor and using it for C2 of impacted endpoints. Some of the top takeaways from these
Recorded Future
ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
blogs_recorded_future·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
# ToolShell Exploit Chain Puts Thousands of SharePoint Servers at Risk
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 has not been impacted.
Read on to understand the ToolShell threat and how to defend against it with hunting packages, including Nuclei and YARA rules, from Recorded Future.
## The latest Tactics, Techniques, and Procedu
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·CVSS 8.8
CVE-2025-53770 [HIGH] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
# Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro
September 22, 2025
Read time: ( words)
Save to Folio
Key takeaways
- CVE-2025-53770 and CVE-2025-53771 are vulnerabilities affecting on-premise Microsoft SharePoint Servers, which enables an attacker to upload malicious files and extract cryptographic secrets.
- These vulnerabilities are evolutions of previously patched flaws (CVE-2025-49704 and CVE-2025-49706), for which initial vendor-provided remediation was incomplete, enabling attackers to achieve
Recorded Future
ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
blogs_recorded_future·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 has not been impacted.
Read on to understand the ToolShell threat and how to defend against it with hunting packages, including Nuclei and YARA rules, from Recorded Future.
## The latest Tactics, Techniques, and Procedures (TTPs)
On July 23, 2025, researchers at LeakIX shared details that
ATT&CK
SharePoint ToolShell Exploitation
mitre_attack·CVSS 8.8
CVE-2025-49706 [HIGH] SharePoint ToolShell Exploitation
SharePoint ToolShell Exploitation
The [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors [Threat Group-3390](https://attack.mitre.org/groups/G0027) and [ZIRCONIUM](https://attack.mitre.org/groups/G0128). [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) targeted multiple regions and industries including
2025-07-08
Published
2025-07-22
Added to CISA KEV
Exploited in the wild