Exploit / PoCcriticalExploited in the wild

Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770)

Help Net Securityby @zeljkazorzJul 22, 2025 · 15:29 UTC (Jul 22, 2025)4 min read2 · 2 reads

Read at helpnetsecurity.com

Analyze CVE-2025-53770 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2025-53770 CVE-2025-49706 CVE-2025-49704 CVE-2025-53771

Tags: cve-2025-53770 cve-2025-49706 cve-2025-49704 cve-2025-53771 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-49704 +1 related CVE CVE-2025-49706	Authenticated Code Injection RCE in Microsoft SharePoint	8.8 group max	100%	KEVRansomware	Jul 8, 2025 KEV Jul 22, 2025
CVE-2025-53770	Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises	9.8	100%	KEVRansomwarePoC ×3	Jul 20, 2025 KEV Jul 20, 2025
CVE-2025-53771	Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing	6.5	100%		Jul 20, 2025

From the original article

4 min read at helpnetsecurity.com

Microsoft pins on-prem SharePoint attacks on Chinese threat actors Attackers are exploiting a zero-day variant (CVE-2025-53770) of a SharePoint remote code execution vulnerability (CVE-2025-49706) that Microsoft patched earlier this month, the company has confirmed on Saturday.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.