CVE-2025-53770criticalunder attackransomwareCWE-502

CVE-2025-53770: critical vulnerability in Microsoft SharePoint Enterprise Server 2016

Microsoft SharePoint Server Remote Code Execution Vulnerability

Published 20 Jul 2025 · Updated 04 Aug 2026

Follow this CVE + Monitor Microsoft SharePoint Server + Monitor Microsoft SharePoint Enterprise Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.8epss 100%

from disclosure to weapon1 day

Published on NVDJul 20

1st PoC+1d

metasploitJul 8

CISA KEVJul 20

Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

CISC Gov.br · 15 Jul 2025Zero-Days TOOLSHELL - SharePoint Serversread on gov.br ↗
CTIR Gov · ALERTA 12/2025Vulnerabilidade no Microsoft SharePoint Serverread on gov.br ↗

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.

Action required by CISAfederal deadline: 2025-07-21

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

In short

Microsoft SharePoint Server has a critical flaw where it processes untrusted data in a way that allows attackers to run malicious code remotely without authorization. This is a severe security issue because it can be exploited over the internet to take full control of affected servers.

Technical detail

CVE-2025-53770 is an unsafe deserialization vulnerability (CWE-502) in on-premises Microsoft SharePoint Server that permits unauthenticated remote code execution. Attackers can exploit this by sending specially crafted network requests containing malicious serialized objects; the server deserializes untrusted input without proper validation, leading to arbitrary code execution with server privileges. Active exploitation has been reported in the wild.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C

Affected products

Microsoft · Microsoft SharePoint Enterprise Server 2016 Microsoft · Microsoft SharePoint Server 2019 Microsoft · Microsoft SharePoint Server Subscription Edition

public PoCs found — 72

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Microsoft SharePoint Enterprise Server 2016

In the same product, most dangerous first.

CVE-2025-49704HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 100.0%KEV CVE-2023-29357CRITICALMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 100.0%KEV CVE-2025-49706MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 99.1%KEV CVE-2023-24955HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 85.0%KEV CVE-2026-45659HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 80.2%KEV CVE-2026-55040CRITICALMicrosoft SharePoint Server Security Feature Bypass VulnerabilityEPSS 69.5%KEV

References

https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/https://github.com/kaizensecurity/CVE-2025-53770 https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 https://news.ycombinator.com/item?id=44629710 https://research.eye.security/sharepoint-under-siege/https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770 https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/