Vulnerabilitycritical

Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch

The Hacker Newsby @TheHackersNewsOct 22, 2025 · 12:56 UTC (Oct 22, 2025)2 min read3

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-53770 CVE-2025-49704 CVE-2025-49706 CVE-2021-36942

Tags: cve-2025-53770 cve-2025-49704 cve-2025-49706 cve-2021-36942 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-36942	Unauthenticated LSA Spoofing (PetitPotam NTLM Relay) in Microsoft Windows	7.5	66%	KEVRansomwarePoC	Aug 12, 2021 KEV Nov 3, 2021
CVE-2025-49704 +1 related CVE CVE-2025-49706	Authenticated Code Injection RCE in Microsoft SharePoint	8.8 group max	100%	KEVRansomware	Jul 8, 2025 KEV Jul 22, 2025
CVE-2025-53770	Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises	9.8	100%	KEVRansomwarePoC ×3	Jul 20, 2025 KEV Jul 20, 2025

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Oct 22, 2025 Cyber Espionage / Vulnerability Threat actors with ties to China exploited the ToolShell security vulnerability in Microsoft SharePoint to breach a telecommunications company in the Middle East after it was publicly disclosed and patched in July 2025.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.