Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-49704 +1 in the same advisory: …49706 | Authenticated Code Injection RCE in Microsoft SharePoint CVE-2025-49704 is a code injection vulnerability (CWE-94) in Microsoft SharePoint that allows an authorized (authenticated) attacker to execute arbitrary code on the server over the network, by sending requests whose attacker-controlled input SharePoint executes as code. It can be chained with CVE-2025-49706, and Microsoft subsequently issued CVE-2025-53770 as a patch bypass of the original CVE-2025-49704 fix, meaning the CVE-2025-53770 updates provide stronger protection and should be treated as the definitive remediation. Successful exploitation yields remote code execution on the SharePoint server, and CISA added the flaw to the KEV on 2025-07-22 with known ransomware use. Organizations running on-premises SharePoint Server are affected; CISA directs owners of public-facing servers running EOL/EOS versions (SharePoint Server 2013 and earlier) to disconnect them, and operators of supported versions to apply the CISA and vendor mitigations and updates, with cloud SharePoint services governed by BOD 22-01. Exploitation is confirmed in the wild and EPSS assigns a 100% probability of exploitation within 30 days (top percentile), although no public proof-of-concept code is documented. Do: Apply Microsoft's SharePoint Server updates for CVE-2025-53770, which supersede the original CVE-2025-49704 fixes with more robust protection, prioritizing internet-facing servers. Disconnect public-facing SharePoint servers running EOL/EOS versions (SharePoint Server 2013 and earlier), and for supported versions follow the CISA and vendor mitigations, with cloud services handled per BOD 22-01. Because in-the-wild exploitation and ransomware use are confirmed, hunt for indicators of compromise and ransomware activity on exposed SharePoint servers. | 8.8 group max | 100% | KEV ransomware |
| masstens of thousands of internet-exposed SharePoint servers per public scans, within a total on-premises install base plausibly exceeding 100,000 deployments… | |
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises CVE-2025-53770 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server on-premises that allows an unauthorized attacker to execute code over a network. It is triggered when the server deserializes attacker-controlled data, can be chained with CVE-2025-53771, and it bypasses the fixes issued for CVE-2025-49704, meaning the earlier patches are insufficient. Successful exploitation yields remote code execution on the SharePoint server, and ransomware operators are known to be using it. Any organization running SharePoint Server on-premises is affected, particularly internet-facing deployments and end-of-life versions such as SharePoint Server 2013 and earlier that can no longer be patched. The flaw is being actively exploited — it was added to CISA's KEV on 2025-07-20 with known ransomware use — and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Apply Microsoft's updated SharePoint Server security updates that fix CVE-2025-53770 — these include more robust protection than the earlier CVE-2025-49704 updates — and ensure the companion CVE-2025-53771 is also addressed, following CISA and vendor mitigation instructions for supported versions. Disconnect public-facing SharePoint Server 2013 or earlier (EOL/EOS) instances, minimize internet exposure of supported servers, and hunt for signs of compromise given the known ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×3 |
| mass≈25,000–100,000 internet-exposed on-premises SharePoint servers (public internet-wide scans); total on-prem installed base plausibly >1M users | |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing CVE-2025-53771 is an improper authentication flaw (CWE-287) in Microsoft's on-premises SharePoint Server that allows an unauthenticated remote attacker to conduct spoofing over the network. Per the CVSS vector, exploitation requires no privileges and no user interaction, so an attacker who can reach the SharePoint server over the network can trigger it directly. Successful exploitation lets the attacker impersonate an authenticated user or component, producing limited but real impact on confidentiality and integrity (CVSS 6.5, medium). Any organization running on-premises SharePoint Server is affected, particularly those exposing it to the internet; no specific version numbers are provided in the source data, so defenders should consult Microsoft's advisory for their edition. No public PoC exists and it is not yet in CISA's KEV, but exploitation likelihood is near-certain (EPSS 99.7%, 100th percentile), and Microsoft has confirmed active China-linked nation-state exploitation of the closely related SharePoint ToolShell vulnerability chain, which has hit roughly 400 organizations including U.S. federal agencies. Do: Apply Microsoft's SharePoint Server security updates that ship this fix as soon as possible, prioritizing internet-facing servers, and treat this as urgent because it was patched alongside the actively exploited ToolShell chain. While patching, review authentication and web-server logs on SharePoint hosts for unexpected successful logons or anomalous requests that could indicate spoofing or compromise, and restrict network access to SharePoint (VPN, firewall rules, segmentation) if patching must be delayed. | 6.5 | 100% |
| largeTens of thousands of internet-facing SharePoint Server deployments, with a total on-prem installed base plausibly in the hundreds of thousands (estimate) |
Full article1,000 words · extracted from helpnetsecurity.com · click to collapse
This is a developing story, new update here:
Microsoft pins on-prem SharePoint attacks on Chinese threat actors
Attackers are exploiting a zero-day variant (CVE-2025-53770) of a SharePoint remote code execution vulnerability (CVE-2025-49706) that Microsoft patched earlier this month, the company has confirmed on Saturday.
CVE-2025-53770 is being leveraged to place a backdoor on vulnerable on-premises SharePoint Servers and to grab the systems’ security keys, allowing the attackers full takeover of the machines.
There is currently no patch available to plug this security hole, but Microsoft says that customers running on-premises SharePoint Servers can stop attackers from exploiting the vulnerability by configuring Antimalware Scan Interface (AMSI) integration in SharePoint and deploying Defender AV on all SharePoint servers.
“AMSI integration was enabled by default in the September 2023 security update for SharePoint Server 2016/2019 and the Version 23H2 feature update for SharePoint Server Subscription Edition,” Microsoft noted.
“If enabling AMSI is not an option, you should remove access to the internet from the SharePoint server. We also recommend you deploy Defender for Endpoint to detect and block post-exploit activity.”
About CVE-2025-53770
CVE-2025-53770 stems from SharePoint’s deserializing of untrusted data, can lead to unauthenticated remote code execution with no user interaction required, and affects on-premises:
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Enterprise Server 2016, and
- Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint as part of Microsoft 365 (i.e., SharePoint Online) is not vulnerable.
CVE-2025-53770 is a variant of CVE-2025-49706, an authentication bypass vulnerability that has been chained with CVE-2025-49704, a code injection vulnerability, to pull off “ToolShell”, an attack devised by Viettel Cyber Security researchers and demonstrated at the Pwn2Own contest in Berlin in May 2025.
Unfortunately, CODE WHITE GmbH researchers releasing a screenshot of the proof of concept exploit for the ToolShell attack and other researchers sharing additional technical details was apparently enough for attackers to create an exploit chain of their own and start looking for and exploiting vulnerable internet-facing SharePoint servers.
CVE-2025-53770 exploitation in the wild
Dutch security outfit Eye Security says that the zero-day has been actively exploited since at least July 18.
“When our team began reviewing the impacted systems, we expected to find the usual suspects: standard web shells designed for command execution, file uploads, or lateral movement. Instead, what we discovered was more subtle, and arguably more dangerous: a stealthy spinstall0.aspx file whose sole purpose was to extract and leak cryptographic secrets from the SharePoint server using a simple GET request,” they shared.
“This wasn’t your typical webshell. There were no interactive commands, reverse shells, or command-and-control logic. Instead, the page invoked internal .NET methods to read the SharePoint server’s MachineKey configuration, including the ValidationKey and DecryptionKey. These keys are essential for generating valid __VIEWSTATE payloads, and gaining access to them effectively turns any authenticated SharePoint request into a remote code execution opportunity.”
Eye Security says that within hours of detecting the initial compromise, they pinpointed more then dozens of servers compromised “using the exact same payload at the same filepath,” and began privately disclosing their findings to national CERTs accross the world and affected organizations across Europe.
Additional victim organizations have been identified by the Dutch Institute for Vulnerability Disclosure, Eye Security said on Sunday.
What to do?
Organizations that took their on-premises Sharepoint Server machine(s) off the internet or have enabled the AMSI integration and deploying Defender AV only after the intial wave of attacks should check their servers’ logs for indicators of compromise.
Eye Security has compiled (and is constantly updating) a list of IoCs and advised organizations to follow Microsoft’s customer guidance. Palo Alto Networks has also shares some IoCs.
Organizations that find evidence of compromise should isolate/shut down the affected servers and renew all credentials and system secrets that could have been exposed via the malicious ASPX.
“These keys allow attackers to impersonate users or services, even after the server is patched. So patching alone does not solve the issue, you need to rotate the secrets allowing all future tokens that can be created by the malicious actor become invalid,” Eye Security explained.
Some organizations may need to call in outside incident response experts to help investigate and contain the compromise.
“Attackers can maintain persistence through backdoors or modified components that survive reboots and updates. So please consult expert incident response services if in doubt,” the Dutch security outfit noted, and warned that because SharePoint often connects to core services like Outlook, Teams, and OneDrive, a breach can quickly lead to data theft, password harvesting, and lateral movement across the network.
CISA has added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog and instructed all US federal civilian executive branch (FCEB) agencies to identify potentially affected systems and to apply mitigations by July 21.
UPDATE (July 21, 2025, 05:15 a.m. ET):
Microsoft has released updates for SharePoint Server Subscription Edition and SharePoint Server 2019 that fix CVE-2025-53770 and CVE-2025-53771, and explained away some of the confusion regarding the exploited variants:
“The update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706,” the company confirmed. (CVE-2025-53771 is currently not being exploited, it seems.)
Microsoft has also updated its customer guidance document with additional information and advice.
UPDATE (July 21, 2025, 07:05 a.m. ET):
According to the Washington Post, CVE-2025-53770 has been leveraged to breach the servers of US federal and state agencies, energy companies and universities, and an Asian telco.
“One private research company found the hackers targeting servers in China as well as a state legislature in the eastern United States. Eye Security said it has tracked more than 50 breaches, including at an energy company in a large state and several European government agencies,” the news outlet reported.
CISA says that the attackers managed to “fully access SharePoint content, including file systems and internal configurations, and execute code over the network.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/07/20/microsoft-sharepoint-servers-under-attack-via-zero-day-vulnerability-with-no-patch-cve-2025-53770/