Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.
78
CVE-2025-53770
Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises
CISA: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 100%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2025-53770 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server on-premises that allows an unauthorized attacker to execute code over a network. It is triggered when the server deserializes attacker-controlled data, can be chained with CVE-2025-53771, and it bypasses the fixes issued for CVE-2025-49704, meaning the earlier patches are insufficient. Successful exploitation yields remote code execution on the SharePoint server, and ransomware operators are known to be using it. Any organization running SharePoint Server on-premises is affected, particularly internet-facing deployments and end-of-life versions such as SharePoint Server 2013 and earlier that can no longer be patched. The flaw is being actively exploited — it was added to CISA's KEV on 2025-07-20 with known ransomware use — and EPSS assigns it a 100% probability of exploitation within 30 days.
What to do: Apply Microsoft's updated SharePoint Server security updates that fix CVE-2025-53770 — these include more robust protection than the earlier CVE-2025-49704 updates — and ensure the companion CVE-2025-53771 is also addressed, following CISA and vendor mitigation instructions for supported versions. Disconnect public-facing SharePoint Server 2013 or earlier (EOL/EOS) instances, minimize internet exposure of supported servers, and hunt for signs of compromise given the known ransomware exploitation.
| Product | Affected |
|---|---|
| Microsoft SharePoint Server (on-premises) | Specific version ranges not enumerated in the source data; Microsoft SharePoint on-premises is affected. CISA notes SharePoint Server 2013 and earlier are EOL/E |
Estimated exposure
mass≈25,000–100,000 internet-exposed on-premises SharePoint servers (public internet-wide scans); total on-prem installed base plausibly >1M users — Estimate based on internet-wide scan counts of exposed SharePoint Server endpoints observed during the July 2025 exploitation wave combined with SharePoint's ubiquity as Microsoft's on-premises collaboration platform across enterprises and…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
KEVCISA Known Exploited Vulnerability
- Affected
- Microsoft SharePoint
- Required action
- Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
- Due date
- Ransomware use
- Known
- Vendors
- microsoft
- Products
- sharepoint server
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
20 storiesWarlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators
China-nexus Longlegs deploys Warlock ransomware via exploited SharePoint flaws against water utility, telecom, government, and university targets across three continents.
78
60
60
60
Vulnerabilities grew like weeds in 2025, but only 1% were weaponized in attacks
60
60
60
60
60
60
60
60
60
60
60
Microsoft fixes "BadSuccessor" Kerberos vulnerability (CVE-2025-53779)
60
60
60
60