PT-2025-30160 · Microsoft · Sharepoint Server

Published

2025-07-19

·

Updated

2025-08-26

·

CVE-2025-53770

Report an issue
CVSS v3.1
10
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Vulnerability Summary

**Name of the Vulnerable Software and Affected Versions:** Microsoft SharePoint Server (affected versions not specified)

**Description:**

A critical zero-day remote code execution (RCE) vulnerability (CVE-2025-53770, also known as “ToolShell”) exists in on-premises Microsoft SharePoint Server. This vulnerability allows unauthenticated attackers to execute arbitrary code, potentially leading to full system compromise, data theft, and the installation of backdoors. The vulnerability stems from a deserialization flaw. Active exploitation has been observed globally, with over 100 organizations reportedly compromised, including government agencies and critical infrastructure providers. Attackers are leveraging this vulnerability to steal cryptographic keys and maintain persistent access. While a patch has been released for some versions, the vulnerability remains a significant threat, particularly for unpatched systems.

**Recommendations:**

* Apply the latest security updates released by Microsoft for SharePoint Server.

* Implement the mitigation strategies provided by Microsoft and CISA.

* Monitor systems for indicators of compromise (IOCs) related to the ToolShell exploit.

* Consider isolating vulnerable systems if patching is not immediately feasible.

* Enable AMSI and ensure EDR visibility.

* Enforce multi-factor authentication (MFA).

* Rotate cryptographic keys.

* Review and audit SharePoint configurations for potential vulnerabilities.

Exploit

Fix

LPE

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-08714
CVE-2025-53770
ZDI-25-653

Affected Products

Sharepoint Server