CVE-2025-53770criticalbajo ataqueransomwareCWE-502

CVE-2025-53770: fallo crítico en Microsoft SharePoint Enterprise Server 2016

Microsoft SharePoint Server Remote Code Execution Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Microsoft SharePoint Server+ Monitorear Microsoft SharePoint Enterprise Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA, tiene alerta oficial del gobierno de Brasil y tiene exploit funcional público.

ssvc Actcvss 9.8epss 100%
de la publicación al arma1 día
Publicada en NVD20 jul
1ª PoC+1d
metasploit8 jul
CISA KEV20 jul
Alerta oficial en Brasil

El gobierno federal de Brasil publicó una alerta, recomendación o boletín que cita esta vulnerabilidad.

Fuente: CTIR Gov (GSI) y CISC Gov.br, bajo licencia CC BY-ND 3.0.
Acción exigida por CISAplazo federal: 2025-07-21

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

En resumen

Microsoft SharePoint Server tiene una falla crítica donde procesa datos no confiables de forma insegura, permitiendo que atacantes ejecuten código malicioso remotamente sin autorización. Este es un problema grave de seguridad porque puede ser explotado a través de internet para tomar control total de los servidores afectados.

Detalle técnico

CVE-2025-53770 es una vulnerabilidad de deserialización insegura (CWE-502) en Microsoft SharePoint Server local que permite ejecución remota de código sin autenticación. Los atacantes pueden explotarla enviando solicitudes de red especialmente elaboradas con objetos serializados maliciosos; el servidor deserializa entrada no confiable sin validación apropiada, resultando en ejecución de código arbitrario con privilegios de servidor. Se ha reportado explotación activa en la naturaleza.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C
Productos afectados
Microsoft · Microsoft SharePoint Enterprise Server 2016Microsoft · Microsoft SharePoint Server 2019Microsoft · Microsoft SharePoint Server Subscription Edition
PoCs públicas encontradas — 72
exploitdbwww.exploit-db.com/exploits/52405no verificadogithubgithub.com/soltanali0/CVE-2025-53770-Exploit★ 316githubgithub.com/MuhammadWaseem29/CVE-2025-53770★ 57githubgithub.com/hazcod/CVE-2025-53770★ 45githubgithub.com/kaizensecurity/CVE-2025-53770★ 44githubgithub.com/ZephrFish/CVE-2025-53770-Scanner★ 18githubgithub.com/3a7/CVE-2025-53770★ 14githubgithub.com/AdityaBhatt3010/CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE★ 11githubgithub.com/exfil0/CVE-2025-53770★ 5githubgithub.com/saladin0x1/CVE-2025-53770★ 4githubgithub.com/Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC★ 4githubgithub.com/Bluefire-Redteam-Cybersecurity/bluefire-sharepoint-cve-2025-53770★ 3githubgithub.com/Sec-Dan/CVE-2025-53770-Scanner★ 3githubgithub.com/J4ck3LSyN-Gen2/CVE-2025-53770★ 2githubgithub.com/0xKr1x/CVE-2025-53770-Scanner★ 2githubgithub.com/Rabbitbong/OurSharePoint-CVE-2025-53770★ 2githubgithub.com/tripoloski1337/CVE-2025-53770-scanner★ 1githubgithub.com/Udyz/CVE-2025-53770-Exploit★ 1githubgithub.com/imbas007/CVE-2025-53770-Vulnerable-Scanner★ 1githubgithub.com/Cameloo1/sharepoint-toolshell-micro-postmortem★ 1githubgithub.com/harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC★ 1githubgithub.com/paolokappa/SharePointSecurityMonitor★ 1githubgithub.com/Zedocun/SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis★ 1githubgithub.com/grupooruss/CVE-2025-53770-Checker★ 1githubgithub.com/rbctee/CVE-2025-53770★ 1githubgithub.com/0xisfet/CVE-2025-53770-Scanner★ 1githubgithub.com/CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend★ 0githubgithub.com/nisargsuthar/suricata-rule-CVE-2025-53770★ 0githubgithub.com/doerrdan/it-sec-toolshell★ 0githubgithub.com/yosasasutsut/Blackash-CVE-2025-53770★ 0githubgithub.com/gmh5225/ZeroPoint★ 0githubgithub.com/GreenForceNetworks/Toolshell_CVE-2025-53770★ 0githubgithub.com/mfarshad-abdullah-khan/cve-2025-53770-research★ 0githubgithub.com/RukshanaAlikhan/CVE-2025-53770★ 0githubgithub.com/zach115th/ToolShellFinder★ 0githubgithub.com/Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell★ 0githubgithub.com/bitsalv/ToolShell-Honeypot★ 0githubgithub.com/BirdsAreFlyingCameras/CVE-2025-53770_Raw-HTTP-Request-Generator★ 0githubgithub.com/victormbogu1/LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320★ 0githubgithub.com/bharath-cyber-root/sharepoint-toolshell-cve-2025-53770★ 0githubgithub.com/0xray5c68616e37/cve-2025-53770★ 0githubgithub.com/bossnick98/-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE★ 0githubgithub.com/r3xbugbounty/CVE-2025-53770★ 0githubgithub.com/daryllundy/CVE-2025-53770★ 0githubgithub.com/Agampreet-Singh/CVE-2025-53770★ 0githubgithub.com/thiconickid/sharepoint-zero-day-cs50-cybersecurity★ 0githubgithub.com/ghostn4444/CVE-2025-53770★ 0githubgithub.com/siag-itsec/CVE-2025-53770-Hunting★ 0vulncheckvulncheck.com/xdb/6e8561b6f99cno verificadovulncheckvulncheck.com/xdb/c643a8c3969cno verificadovulncheckvulncheck.com/xdb/9144508904c1no verificadovulncheckvulncheck.com/xdb/5bcc8e582461no verificadovulncheckvulncheck.com/xdb/51df78344fd2no verificadovulncheckvulncheck.com/xdb/61f35dc317eeno verificadovulncheckvulncheck.com/xdb/b07b4056ae83no verificadovulncheckvulncheck.com/xdb/44954e7e670dno verificadovulncheckvulncheck.com/xdb/8f8c644e7a29no verificadovulncheckvulncheck.com/xdb/28f126b21908no verificadovulncheckvulncheck.com/xdb/4aa1e489b5bdno verificadovulncheckvulncheck.com/xdb/bcccd72ac61bno verificadovulncheckvulncheck.com/xdb/040342045c8ano verificadovulncheckvulncheck.com/xdb/436b5b65d72ano verificadovulncheckvulncheck.com/xdb/de880bd2afb1no verificadovulncheckvulncheck.com/xdb/a45944bad382no verificadovulncheckvulncheck.com/xdb/f68dbdcf33e0no verificadovulncheckvulncheck.com/xdb/cdfb6637e182no verificadovulncheckvulncheck.com/xdb/8f2279dbd625no verificadovulncheckvulncheck.com/xdb/eb64e3ff9e58no verificadovulncheckvulncheck.com/xdb/6144126cb2b0no verificadovulncheckvulncheck.com/xdb/fd86e5458039no verificadovulncheckvulncheck.com/xdb/3370992d69e8no verificadovulncheckvulncheck.com/xdb/56876df800cano verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Microsoft SharePoint Enterprise Server 2016

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-49704HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2023-29357CRITICALMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2025-49706MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 99.1%KEVCVE-2023-24955HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 85.0%KEVCVE-2026-45659HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 80.2%KEVCVE-2026-55040CRITICALMicrosoft SharePoint Server Security Feature Bypass VulnerabilityEPSS 69.5%KEV