CVE-2025-53771
published 2025-07-20CVE-2025-53771: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
PriorityP186medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
99.91%
100.0th percentile
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5513.1001 | 16.0.5513.1001 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10417.20037 | 16.0.10417.20037 |
| microsoft | microsoft_sharepoint_server_subscription_edition | >= 16.0.0 < 16.0.18526.20508 | 16.0.18526.20508 |
| microsoft | sharepoint_server | < 16.0.18526.20508 | 16.0.18526.20508 |
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
Detection & IOCsextracted from sources · hover to see the quote
sigma↗
DeviceFileEvents | where FolderPath has "MICROS~1\\WEBSER~1\\16\\TEMPLATE\\LAYOUTS" | where FileName =~ "spinstall0.aspx" or FileName has "spinstall0" | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ReportId, ActionType, SHA256 | order by Timestamp desc
- →Detect ToolShell auth bypass: look for HTTP POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit with a Referer header of /_layouts/SignOut.aspx in IIS logs ↗
- →Detect web shell drop: monitor for creation of spinstall0.aspx (or any file matching 'spinstall0') under the SharePoint LAYOUTS directory (MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS) ↗
- →Detect post-exploitation RCE: alert on w3wp.exe spawning encoded PowerShell child processes on SharePoint servers ↗
- →CVE-2025-53771 auth bypass mechanism: the forged Referer header /_layouts/SignOut.aspx causes SharePoint to treat the request as authenticated — flag any POST to ToolPane.aspx with this Referer ↗
- →Threat actor attribution: at least one early exploiting actor is a China-nexus threat actor; Storm-2603 has been specifically linked to ToolShell activity starting July 2025 ↗
- ·CVE-2025-53771 only affects on-premises SharePoint Server deployments; SharePoint Online (Microsoft 365) is NOT impacted ↗
- ·Self-managed SharePoint Server instances hosted in cloud environments (Azure, AWS, GCP) are also vulnerable — cloud hosting does not provide protection ↗
- ·In many reported cases it is unclear whether exploitation used the original CVEs (CVE-2025-49704/49706) or the newer bypass variants (CVE-2025-53770/53771); both patch sets must be applied ↗
- ·SharePoint Server 2010 and 2013 are end-of-life and will not receive patches but are confirmed affected — they should be isolated or upgraded ↗
- ·Machine key rotation must be performed after patching; stolen ValidationKey/DecryptionKey values allow continued RCE via forged __VIEWSTATE even on patched servers if keys are not rotated ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft SharePoint Improper Authentication Vulnerability
cisa·2025-07-22·CVSS 8.8
CVE-2025-49706 [HIGH] CWE-287 Microsoft SharePoint Improper Authentication Vulnerability
Vulnerability: Microsoft SharePoint Improper Authentication Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions
CISA
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
cisa·2025-07-20·CVSS 8.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Vulnerability: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendo
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability
vendor_msrc·2025-07-08·CVSS 6.5
CVE-2025-53771 [HIGH] CWE-287 Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
Description: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
FAQ: Are the two new CVEs that were released related to the two SharePoint vulnerabilities that were documented by CVE-2025-49704 and CVE-2025-49706?
Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.
FAQ: There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on th
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability
vendor_msrc·2025-07-08·CVSS 9.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Description: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
FAQ: 7/20/2025 Update: Updates are now available for Microsoft SharePoint Server Subscription Edition and Microsoft SharePoint Server 2019.
Why are there no links to the update to protect from this vulnerability?
Microsoft is preparing and fully testing a comprehen
GHSA
GHSA-6pmq-337c-gv96: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to perform
ghsa_unreviewed·2025-07-21
CVE-2025-53771 [MEDIUM] CWE-20 GHSA-6pmq-337c-gv96: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to perform
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
VulnCheck
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions
VulnCheck
Microsoft SharePoint Code Injection Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-49704 [HIGH] CWE-94 Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD
VulnCheck
Microsoft SharePoint Improper Authentication
vulncheck·2025·CVSS 6.5
CVE-2025-53771 [MEDIUM] Microsoft SharePoint Improper Authentication
Microsoft SharePoint Improper Authentication
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Affected: Microsoft SharePoint
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://research.eye.security/sharepoint-under-siege/; https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities; https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/; https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2
VulnCheck
Microsoft SharePoint Improper Authentication Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-49706 [HIGH] CWE-287 Microsoft SharePoint Improper Authentication Vulnerability
Microsoft SharePoint Improper Authentication Vulnerability
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follo
Elastic
Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)
elastic_rules·CVSS 9.8
CVE-2025-53770 [CRITICAL] Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)
Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)
Identifies potential exploitation of CVE-2025-53770 and CVE-2025-53771 in IIS web servers on SharePoint sites. Toolshell
is an exploit chain that leverages vulnerabilities in SharePoint/IIS to gain unauthorized access and execute commands.
This rule detects HTTP requests that match specific patterns indicative of the exploit attempt.
Query:
data_stream.dataset : "network_traffic.http" and
url.path: (/_layouts*ToolPane.aspx* or /_layouts*toolpane.aspx*) and
http.request.referrer: *SignOut.aspx and
network.direction: "ingress" and
http.request.method: "POST" and
request: (*MSOTlPn_Uri* and *DisplayMode*) and
http.request.body.bytes > 2000
Elastic
Potential VIEWSTATE RCE Attempt on SharePoint/IIS
elastic_rules·CVSS 9.8
[CRITICAL] Potential VIEWSTATE RCE Attempt on SharePoint/IIS
Potential VIEWSTATE RCE Attempt on SharePoint/IIS
Detects potential remote code execution (RCE) attempts targeting IIS web servers running SharePoint via malicious
VIEWSTATE payloads in HTTP POST requests. Attackers may exploit insecure deserialization in the VIEWSTATE parameter to
execute arbitrary code. This rule identifies suspicious requests containing VIEWSTATE data and other indicators of
exploitation, specifically those associated with the Toolshell exploit chain. Toolshell leverages vulnerabilities
(CVE-2025-53770 and CVE-2025-53771) for initial access, enabling adversaries to deploy a webshell, steal machine keys,
sign VIEWSTATE payloads offline, and subsequently send signed payloads to the server to achieve code execution.
Query:
data_stream.dataset : "network_traffic.http" an
Nuclei
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
nuclei·CVSS 6.5
CVE-2025-53771 [MEDIUM] Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /_layouts/15/ToolPane.aspx with a forged Referer header (/_layouts/SignOut.aspx), attackers can bypass authentication mechanisms and gain unauthorized access to protected endpoints. This vulnerability is part of the ToolShell exploit chain and is a patch bypass for CVE-2025-49706. When chained with CVE-2025-53770 (deserialization vulnerability), it enables unauthenticated remote code execution on SharePoint Server.
Template:
id: CVE-2025-53771
info:
name: Microsoft SharePoint Server - Authentication Bypass (ToolShell)
author: _l0gg,SamIntru
Nuclei
Microsoft SharePoint Server - Authentication Bypass
nuclei·CVSS 6.5
CVE-2025-49706 [MEDIUM] Microsoft SharePoint Server - Authentication Bypass
Microsoft SharePoint Server - Authentication Bypass
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Template:
id: CVE-2025-49706
info:
name: Microsoft SharePoint Server - Authentication Bypass
author: daffainfo
severity: medium
description: |
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
impact: |
Unauthenticated attackers can spoof authentication by manipulating the Referer header to access ToolPane functionality, potentially enabling unauthorized actions on SharePoint sites.
remediation: |
Apply the Microsoft security patches for SharePoint Server as described in the MSRC update guide.
reference:
- https://msrc.microsoft.com/update-gu
Metasploit
Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
metasploit·CVSS 8.8
CVE-2025-49706 [HIGH] Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704, and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path. As this exploit module does not target the endpoint associated with CVE-2025-53770 (per the original finders), we believe this module is best described as exploiting CVE-2025-49704 and not CVE-2025-53770.
Nuclei
Microsoft SharePoint Server - Remote Code Execution (ToolShell)
nuclei·CVSS 9.8
CVE-2025-53770 [CRITICAL] Microsoft SharePoint Server - Remote Code Execution (ToolShell)
Microsoft SharePoint Server - Remote Code Execution (ToolShell)
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 (authentication bypass), enables unauthenticated remote code execution. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Template:
id: CVE-2025-53770
info:
name: Microsoft SharePoint Server - Remote Code Execution (ToolShell)
aut
Mandiant
Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
blogs_mandiant·2026-03-16
Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
## Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
## Google Threat Intelligence Group
## Google Threat Intelligence
Visibility and context on the threats that matter most.
Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark
## Introduction
Since 2018, when many financially motivated threat actors began shifting their monetization strategy to post-compromise ransomware deployments, ransomware has become one of the most pervasive threats to organizations across almost every industry vertical and region. In recent years ransomware operations have evolved, creating a robust ecosystem that has lowered the barrier to entry via the commoditization and specialization of the supporting underground communities, w
Mandiant
Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape
blogs_mandiant·2026-03-16
Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape
Threat Intelligence
# Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
March 16, 2026
##### Google Threat Intelligence Group
##### Google Threat Intelligence
Visibility and context on the threats that matter most.
Contact Us & Get a Demo
Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark
### Introduction
Since 2018, when many financially motivated threat actors began shifting their monetization strategy to post-compromise ransomware deployments, ransomware has become one of the most pervasive threats to organizations across almost every industry vertical and region. In recent years ransomware operations have evolved, creating a robust ecosystem that has lowered the barrier to entry via the commoditiza
Checkpoint
Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
blogs_checkpoint·2025-12-16
CVE-2025-49706 Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
## Key Findings
In recent months, Check Point Research has identified a new wave of at
Securelist
Exploits and vulnerabilities in Q3 2025
blogs_securelist·2025-12-03·CVSS 7.8
CVE-2025-49704 [HIGH] Exploits and vulnerabilities in Q3 2025
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
Interesting vulnerabilities
ToolShell (CVE-2025-49704 and CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771): insecure deserialization and an authentication bypass
CVE-2025-8088: a directory traversal vulnerability in WinRAR
CVE-2025-41244: a privilege escalation vulnerability in VMware Aria Operations and VMware Tools
Conclusion and advice
Authors
Alexander Kolesnikov
In the third quarter, attackers continued to exploit security flaws in WinRAR, while the total number of registered vulnerabilities grew again. In this report, we examine statistics on published vuln
Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm
blogs_huntress·2025-12-03
Velociraptor Misuse, Pt. II: The Eye of the Storm
Acknowledgements: Special thanks to Ben Folland, Anna Pham, Michael Tigges, and Anton Ovrutsky for contributing to this investigation and writeup.
We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Velociraptor is a digital forensics and incident response (DFIR) tool that we have seen threat actors abuse recently in attacks in order to set up command-and-control (C2) communications.
Beyond this most recent incident, the Huntress SOC investigated and reported three incidents through September and November that involved the threat actor installing Velociraptor and using it for C2 of impacted endpoints. Some of the top takeaways from these
Securelist
Analyzing the vulnerability landscape in Q3 2025
blogs_securelist·2025-12-03
Analyzing the vulnerability landscape in Q3 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- C2 frameworks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
In the third quarter, attackers continued to exploit security flaws in WinRAR, while the total number of registered vulnerabilities grew again. In this report, we examine statistics on published vulnerabilities and exploits, the most common security issues impacting Windows and Linux, and the vulnerabilities being leveraged in APT attacks that lead to the launch of widespread C2 frameworks. The report utilizes anonymized Kaspersky Security Network data, which was consensually provided by our users, as well as information from open sources.
## Statistics on
Talos
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
blogs_talos·2025-10-23
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagements – a notable increase from less than 10 percent last quarter. This spike is largely attributable to a wave of engagements involving ToolShell, an attack chain that targets on-premises Microsoft SharePoint servers through exploitation of vulnerabilities that were publicly disclosed in July. We also saw an increase in post-exploitation phishing campaigns launched from compromised valid accounts this quarter, a trend we noted last quarter, with threat actors using this technique to expand their attack both within the compromised organizations as well as to external partner entities.
Watch this di
Talos
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
blogs_talos·2025-10-23
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
## IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagements – a notable increase from less than 10 percent last quarter. This spike is largely attributable to a wave of engagements involving ToolShell , an attack chain that targets on-premises Microsoft SharePoint servers through exploitation of vulnerabilities that were publicly disclosed in July. We also saw an increase in post-exploitation phishing campaigns launched from compromised valid accounts this quarter, a trend we noted last quarter, with threat actors using this technique to expan
Tenable
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
blogs_tenable·2025-08-08
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
blogs_unit42·2025-08-05·CVSS 8.8
CVE-2025-49704 [HIGH] Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
## Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
Hiroaki Hara
Mark Lim
Published: August 5, 2025
High Profile Threats
Threat Research
Vulnerabilities
Backdoor
CL-CRI-1040
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
LockBit
Microsoft
SharePoint
Storm-2603
## Executive Summary
Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.
Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis o
Unit42
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
blogs_unit42·2025-08-05
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
## Executive Summary
Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.
Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis of host- and network-based artifacts, we assess with high confidence that Storm-2603 is related to the activity cluster that we track as CL-CRI-1040. We initially noted this in our threat brief covering exploitation of recent SharePoint vulnerabilities, and here further expand on our observations. (See Table 1 in the
Bleepingcomputer
Ransomware gangs join attacks targeting Microsoft SharePoint servers
blogs_bleepingcomputer·2025-08-04·CVSS 8.8
[HIGH] Ransomware gangs join attacks targeting Microsoft SharePoint servers
## Ransomware gangs join attacks targeting Microsoft SharePoint servers
## Sergiu Gatlan
The loader was spotted following a failed exploitation attempt that revealed malicious PowerShell commands designed to disable security monitoring on the targeted device.
"Analysis of the 4L4MD4R payload revealed that it is UPX-packed and written in GoLang. Upon execution, the sample decrypts an AES-encrypted payload in memory, allocates memory to load the decrypted PE file, and creates a new thread to execute it," Unit 42 said .
The 4L4MD4R ransomware encrypts files on the compromised system and demands a payment of 0.005 Bitcoin, generating ransom notes and encrypted file lists on infected systems.
Microsoft and Google have also linked the ToolShell attacks to Chinese threat actors, with Micros
Checkpoint
Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
blogs_checkpoint·2025-07-31
CVE-2025-49704 Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
## Key Findings
Check Point Research (CPR) conducted a focused analysis of Storm-2603 , a threat actor associated
Unit42
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
blogs_unit42·2025-07-31·CVSS 8.8
CVE-2025-49704 [HIGH] Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
Threat Research Center
High Profile Threats
Vulnerabilities
## Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
Unit 42
Published: July 31, 2025
High Profile Threats
Vulnerabilities
CL-CRI-1040
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
Microsoft
SharePoint
Zero-day
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.
Update July 31, 2025
An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.
A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led
Unit42
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
blogs_unit42·2025-07-31·CVSS 8.8
CVE-2025-49704 [HIGH] Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.
Update July 31, 2025
An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.
A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led to the discovery of a loader designed to download and execute the ransomware from hxxps://ice.theinnovationfactory[.]it/static/4l4md4r.exe (145.239.97[.]206).
The PowerShell command attempted to disable real-time monitoring and bypass certificate validation. Full details are in the Scope of Attack section.
Update July 29, 2025
Unit 42 telemetr
Checkpoint
28th July – Threat Intelligence Report
blogs_checkpoint·2025-07-28·CVSS 9.8
CVE-2025-53770 [CRITICAL] 28th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 28th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The US Energy Department, including its National Nuclear Security Administration (NNSA), was reportedly breached as part of a Microsoft SharePoint vulnerability exploit. The breach was linked to a broader espionage campaign, that targeted government agencies via the CVE-2025-53770 The extent of the intrusion and data compromise
Securelist
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
blogs_securelist·2025-07-25·CVSS 7.8
CVE-2025-49706 [HIGH] ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Table of Contents
- The exploit
- CVE-2025-49706
- CVE-2025-53771
- CVE-2025-49704
- CVE-2025-53770
- CVE-2020-1147
- Conclusions
Authors
- Boris Larin
- Georgy Kucherin
- Ilya Savelyev
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously
Fortinet
Inside The ToolShell Campaign | FortiGuard Labs
blogs_fortinet·2025-07-25·CVSS 8.8
[HIGH] Inside The ToolShell Campaign | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Inside The ToolShell Campaign
New “ToolShell” Exploit Chain Targets Unpatched and Zero-Day SharePoint Vulnerabilities for Remote Code Execution
FORTIGUARD SECURITY PORTFOLIO 2025 THREAT LANDSCAPE REPORT
Probing Action
GhostWebShell
KeySiphon
Conclusion
Fortinet Protections
IOCs
By Cara Lin | July 25, 2025
Affected Platforms: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition
Impacted Users: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: Critical
FortiGuard Labs is currently tracking multiple threat actors targeting on-premises Microsoft SharePoint servers. This attack leverages a newly identified exploit chain dubbed "ToolS
Securelist
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
blogs_securelist·2025-07-25·CVSS 7.8
CVE-2025-49706 [HIGH] ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Table of Contents
The exploit
CVE-2025-49706
CVE-2025-53771
CVE-2025-49704
CVE-2025-53770
CVE-2020-1147
Conclusions
Authors
Boris Larin
Georgy Kucherin
Ilya Savelyev
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706 , publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771 , aimed at addressing the security bypasses of previously issued fix
Tenable
Cybersecurity Snapshot: SharePoint Attacks Trigger Urgent Patching Calls, While U.S. Gov’t Unveils AI Innovation Plan
blogs_tenable·2025-07-25
Cybersecurity Snapshot: SharePoint Attacks Trigger Urgent Patching Calls, While U.S. Gov’t Unveils AI Innovation Plan
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits & Vulnerabilities
## Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research Jul 22, 2025 Read time: ( words)
Save to Folio
Table 1. Summary of the MITRE ATT&CK tools, tactics, and procedures used in attacks that exploit CVE-2025-53770 and CVE-2025-53771
Bleepingcomputer
Microsoft links Sharepoint ToolShell attacks to Chinese hackers
blogs_bleepingcomputer·2025-07-22·CVSS 8.8
[HIGH] Microsoft links Sharepoint ToolShell attacks to Chinese hackers
## Microsoft links Sharepoint ToolShell attacks to Chinese hackers
## Sergiu Gatlan
"We assess that at least one of the actors responsible for this early exploitation is a China-nexus threat actor. It's critical to understand that multiple actors are now actively exploiting this vulnerability," Charles Carmakal, CTO of Google Cloud's Mandiant Consulting, told BleepingComputer yesterday.
On Friday, Dutch cybersecurity firm Eye Security first spotted zero-day attacks exploiting the CVE-2025-49706 and CVE-2025-49704 vulnerabilities (first demoed during the Berlin Pwn2Own hacking contest by Viettel Cyber Security researchers).
The company told BleepingComputer that at least 54 organizations had already been compromised, including several multinational companies and national government enti
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits & Vulnerabilities
## Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research 2025/07/22 Read time: ( words)
Save to Folio
Table 1. Summary of the MITRE ATT&CK tools, tactics, and procedures used in attacks that exploit CVE-2025-53770 and CVE-2025-53771
Microsoft
Disrupting active exploitation of on-premises SharePoint vulnerabilities
blogs_microsoft·2025-07-22
Disrupting active exploitation of on-premises SharePoint vulnerabilities
Research
July 22, 2025
## Microsoft Sentinel
Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.
Our post on web shell threat hunting with Microsoft Sentinel also provides guidance on looking for web shells in general. Several hunting queries are also available below:
Web shell detection
Possible Webshell drop
Malicious web application requests linked with Microsoft Defender for Endpoint alerts
Web sh
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits y vulnerabilidades
## Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research Jul 22, 2025 Read time: ( words)
Save to Folio
Table 1. Summary of the MITRE ATT&CK tools, tactics, and procedures used in attacks that exploit CVE-2025-53770 and CVE-2025-53771
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 8.8
CVE-2025-53770 [HIGH] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits & Vulnerabilities
# Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research
2025/07/22
Read time: ( words)
Save to Folio
Key takeaways
- CVE-2025-53770 and CVE-2025-53771 are vulnerabilities affecting on-premise Microsoft SharePoint Servers, which enables an attacker to upload malicious files and extract cryptographic secrets.
- These vulnerabilities are evolutions of previously patched flaws (CVE-2025-49704 and CVE-2025-49706), for which initial vendor-provided remediation was inc
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Ausnutzung von Schwachstellen
## Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research Jul 22, 2025 Read time: ( words)
Save to Folio
Table 1. Summary of the MITRE ATT&CK tools, tactics, and procedures used in attacks that exploit CVE-2025-53770 and CVE-2025-53771
Wiz
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
blogs_wiz·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.
# What are CVE-2025-53770 and CVE-2025-53771?
CVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.
CVE-2025-53771 (CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.
These vuln
Bleepingcomputer
Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
blogs_bleepingcomputer·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
## Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
## Lawrence Abrams
Using these flaws, the threat actors have been conducting ToolShell attacks on SharePoint servers worldwide , impacting over 54 organizations so far.
## Emergency updates released
Microsoft has now rushed out emergency out-of-band security updates for Microsoft SharePoint Subscription Edition, SharePoint 2019, and SharePoint 2016 that fix both the CVE-2025-53770 and CVE-2025-53771 flaws.
"Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706," reads a note in Microsoft advisories.
Microsoft SharePoint admins should install the followin
Talos
ToolShell: Details of CVEs affecting SharePoint servers
blogs_talos·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] ToolShell: Details of CVEs affecting SharePoint servers
## ToolShell: Details of CVEs affecting SharePoint servers
Update 2025/07/22: Microsoft has released a security update for Sharepoint Enterprise Server 2016. The update, with the ID KB5002760, is available in the following link .
Cisco Talos is aware of the ongoing exploitation of CVE-2025-53770 and CVE-2025-53771 in the wild. These are path traversal vulnerabilities affecting SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. According to Microsoft, these vulnerabilities do not affect SharePoint Online in Microsoft 365 and only apply to on-premises SharePoint servers.
Microsoft has also released security updates and mitigation guidance for multiple affected products. The update for Sharepoint Server 2016 has also been released .
These two vulne
Krebs
Microsoft Fix Targets Attacks on SharePoint Zero-Day
blogs_krebs·2025-07-21·CVSS 6.5
CVE-2025-53770 [MEDIUM] Microsoft Fix Targets Attacks on SharePoint Zero-Day
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch comes amid reports that malicious hackers have used the SharePoint flaw to breach U.S. federal and state agencies, universities, and energy companies.
In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770, Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, 2025 security update.
The Cybersecurity & Infrastructure Security Agency (CISA) concurred, saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier this month (CVE-2025-49706). Microsoft
Wiz
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
blogs_wiz·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.
## What are CVE-2025-53770 and CVE-2025-53771?
CVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.
CVE-2025-53771 (CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.
These vul
Qualys
ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities | Qualys
blogs_qualys·2025-07-21·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities | Qualys
#### Table of Contents
- CVE-2025-53770: Critical Remote Code Execution
- CVE-2025-53771: Server Spoofing Vulnerability
- History of the Vulnerabilities
- Who is Affected?
- Qualys QID Coverage
- Eliminating Risk of these Vulnerabilities with the Qualys Enterprise TruRiskTM Platform
On July 19, 2025, Microsoft issued an emergency out-of-band security update to address two zero-day vulnerabilities in Microsoft SharePoint Server: CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are under active exploitation in the wild and demand immediate attention to protect your on-premises SharePoint environments.
## CVE-2025-53770: Critical Remote Code Execution
The first of the two vulnerabilities, CVE-2025-53770, is a critical-severity vulnerability with a CVSS score of 9.8 out of 10. Succ
Krebs
Microsoft Fix Targets Attacks on SharePoint Zero-Day
blogs_krebs·2025-07-21·CVSS 6.5
CVE-2025-53770 [MEDIUM] Microsoft Fix Targets Attacks on SharePoint Zero-Day
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch comes amid reports that malicious hackers have used the SharePoint flaw to breach U.S. federal and state agencies, universities, and energy companies.
Image: Shutterstock, by Ascannio.
In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770 , Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, 2025 security update .
The Cybersecurity & Infrastructure Security Agency (CISA) concurred , saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier t
Qualys
ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities
blogs_qualys·2025-07-21·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities
## Table of Contents
CVE-2025-53770: Critical Remote Code Execution
CVE-2025-53771: Server Spoofing Vulnerability
History of the Vulnerabilities
Who is Affected?
Qualys QID Coverage
Eliminating Risk of these Vulnerabilities with the Qualys Enterprise TruRiskTM Platform
On July 19, 2025, Microsoft issued an emergency out-of-band security update to address two zero-day vulnerabilities in Microsoft SharePoint Server: CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are under active exploitation in the wild and demand immediate attention to protect your on-premises SharePoint environments.
## CVE-2025-53770: Critical Remote Code Execution
The first of the two vulnerabilities, CVE-2025-53770, is a critical-severity vulnerability with a CVSS score of 9.8 out of 10. Successful ex
Talos
ToolShell: Details of CVEs affecting SharePoint servers
blogs_talos·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] ToolShell: Details of CVEs affecting SharePoint servers
Update 2025/07/22: Microsoft has released a security update for Sharepoint Enterprise Server 2016. The update, with the ID KB5002760, is available in the following link.
Cisco Talos is aware of the ongoing exploitation of CVE-2025-53770 and CVE-2025-53771 in the wild. These are path traversal vulnerabilities affecting SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. According to Microsoft, these vulnerabilities do not affect SharePoint Online in Microsoft 365 and only apply to on-premises SharePoint servers.
Microsoft has also released security updates and mitigation guidance for multiple affected products. The update for Sharepoint Server 2016 has also been released.
These two vulnerabilities, CVE-2025-53770 / CVE-2025-53771, are related to CV
Bleepingcomputer
Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
blogs_bleepingcomputer·2025-07-20·CVSS 8.8
CVE-2025-53770 [HIGH] Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
## Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
## Lawrence Abrams
While Microsoft patched both ToolShell flaws as part of the July Patch Tuesday , it is now warning that threat actors were able to bypass the fixes with new exploits.
These new vulnerabilities are tracked as CVE-2025-53770 (bypasses CVE-2025-49704) and CVE-2025-53771 (CVE-2025-49706), and are actively exploited attacks against on-premise SharePoint servers.
"Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update," warns a new Microsoft blog post .
"These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 is not impacted."
Microsoft has
Tenable
CVE-2025-53770: Frequently Asked Questions About Zero-Day SharePoint Vulnerability Exploitation
blogs_tenable·2025-07-20·CVSS 9.8
[CRITICAL] CVE-2025-53770: Frequently Asked Questions About Zero-Day SharePoint Vulnerability Exploitation
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
## Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro April 03, 2026 Read time: ( words)
Save to Folio
Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress
blogs_huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress
Acknowledgements: Special thanks to Ben Folland, Anna Pham, Michael Tigges, and Anton Ovrutsky for contributing to this investigation and writeup.
We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Velociraptor is a digital forensics and incident response (DFIR) tool that we have seen threat actors abuse recently in attacks in order to set up command-and-control (C2) communications.
Beyond this most recent incident, the Huntress SOC investigated and reported three incidents through September and November that involved the threat actor installing Velociraptor and using it for C2 of impacted endpoints. Some of the top takeaways from these
Recorded Future
ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
blogs_recorded_future·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
# ToolShell Exploit Chain Puts Thousands of SharePoint Servers at Risk
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 has not been impacted.
Read on to understand the ToolShell threat and how to defend against it with hunting packages, including Nuclei and YARA rules, from Recorded Future.
## The latest Tactics, Techniques, and Procedu
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·CVSS 8.8
CVE-2025-53770 [HIGH] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
# Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro
September 22, 2025
Read time: ( words)
Save to Folio
Key takeaways
- CVE-2025-53770 and CVE-2025-53771 are vulnerabilities affecting on-premise Microsoft SharePoint Servers, which enables an attacker to upload malicious files and extract cryptographic secrets.
- These vulnerabilities are evolutions of previously patched flaws (CVE-2025-49704 and CVE-2025-49706), for which initial vendor-provided remediation was incomplete, enabling attackers to achieve
Recorded Future
ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
blogs_recorded_future·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 has not been impacted.
Read on to understand the ToolShell threat and how to defend against it with hunting packages, including Nuclei and YARA rules, from Recorded Future.
## The latest Tactics, Techniques, and Procedures (TTPs)
On July 23, 2025, researchers at LeakIX shared details that
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
## Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro September 22, 2025 Read time: ( words)
Save to Folio
arXiv
Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations
arxiv_fulltext·2025-08-14
Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations
-30pt
footnote0
## Abstract
Advances in artificial intelligence are widely understood to have implications for cybersecurity. Articles have emphasized the effect of AI on the cyber offense-defense balance, and credible commentators can be found arguing either that cyber will privilege attackers or defenders. For defenders, arguments are often made that AI will enable solutions like formal verification of all software—and for some well-equipped companies, this may be true. This conversation, however, does not match the reality for most companies. ``Trailing-edge organizations,'' as we term them, rely heavily on legacy software, poorly staff security roles, and struggle to implement best practices like rapid deployment of security patches. These decisions may be the result of corporate ine
ATT&CK
SharePoint ToolShell Exploitation
mitre_attack·CVSS 8.8
CVE-2025-49706 [HIGH] SharePoint ToolShell Exploitation
SharePoint ToolShell Exploitation
The [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors [Threat Group-3390](https://attack.mitre.org/groups/G0027) and [ZIRCONIUM](https://attack.mitre.org/groups/G0128). [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) targeted multiple regions and industries including
2025-07-20
Published
Exploited in the wild