CVE-2025-53771

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint Server (affected versions not specified)

Description The issue involves improper authentication and a path traversal flaw in Microsoft Office SharePoint Server. This allows an unauthorized attacker to perform spoofing over a network. The vulnerability is actively exploited, with reports indicating approximately 400+ compromised systems globally. Exploitation can lead to credential theft and privileged access. The vulnerability is a patch bypass, meaning systems may remain vulnerable even after applying previous fixes. A key indicator of compromise is a 'GET' request to the

/ layouts/15/ToolPane.aspx

endpoint, observed from Microsoft IP addresses. The vulnerability allows Remote Code Execution (RCE) through the

ToolPane.aspx

page by sending a specially crafted POST request with

DisplayMode=Edit

, potentially leading to full server compromise, including web shell installation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.