Log in Request a demo

Exploited vulnerability

SharePoint ToolShell remote code execution (CVE-2025-53770)

CVE-2025-53770

CVE-2025-53770 is a flaw in on-premises Microsoft SharePoint Server that lets an unauthorized attacker run code over a network.

  • On CISA KEV
CVE ID
CVE-2025-53770
CISA KEV
Listed
Affected product
SharePoint Server (on-premises)
Exploited
Yes
Published
July 2025

In short

CVE-2025-53770 is a flaw in on-premises Microsoft SharePoint Server that lets an unauthorized attacker run code over a network. It is a patch bypass for CVE-2025-49704, part of the attack chain publicly reported as ToolShell. CISA added it to its exploited vulnerabilities list on 20 July 2025.

Profile MapVulnerability
  1. CVECVE-2025-53770
  2. ProductMicrosoft SharePoint Server (on-premises)
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps4actions listedRotate ASP.NET machine keys

What it allows

An attacker with no account can run code on an internet-facing SharePoint server. Deserialization of untrusted data means the server rebuilds objects from data an attacker controls, which can be turned into code execution. CISA describes the ToolShell chain as giving access to SharePoint content, including file systems and internal configuration, and says malware seen in the attacks can be used to obtain machine keys.

Who is affected

The flaw affects on-premises SharePoint Server. The National Vulnerability Database lists SharePoint Server Subscription Edition below build 16.0.18526.20508, SharePoint Server 2016 and SharePoint Server 2019. Microsoft's fixed builds are 16.0.18526.20508 for Subscription Edition, 16.0.10417.20037 for 2019 and 16.0.5513.1001 for 2016. CISA's catalog tells organizations to disconnect public-facing end-of-life versions, including SharePoint Server 2013 and earlier.

Microsoft stated that an exploit for CVE-2025-53770 exists in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 20 July 2025, with a due date of 21 July 2025. Microsoft released updates for SharePoint Server Subscription Edition and 2019 on 20 July 2025. CISA says CVE-2025-53770 bypasses the earlier fix for CVE-2025-49704, and Microsoft says its update includes more robust protection.

CISA's alert, in an update, says threat actors were seen encrypting files and distributing Warlock ransomware, and the catalog marks known ransomware campaign use as Known. The exploitation is covered in the incident pages linked below.

What to do

  1. Apply Microsoft's security updates

    Install the update for your SharePoint version: build 16.0.18526.20508 or later for Subscription Edition, 16.0.10417.20037 for 2019, 16.0.5513.1001 for 2016. Microsoft says to apply all updates offered for the software.

  2. Turn on AMSI and endpoint protection

    Microsoft says farms with the AMSI integration enabled and Microsoft Defender in use are protected. AMSI is a Windows feature that lets antivirus inspect requests. CISA also recommends deploying EDR protection against post-exploitation activity.

  3. Rotate ASP.NET machine keys

    CISA says to rotate the machine keys, apply the update, rotate them again and restart IIS. Restarting IIS without removing malicious module entries lets those modules reload.

  4. Disconnect what you cannot protect

    CISA says to disconnect public-facing SharePoint servers when AMSI cannot be enabled, and to disconnect end-of-life versions such as SharePoint Server 2013 and earlier.

Questions

What is CVE-2025-53770 (ToolShell)?

CVE-2025-53770 is a flaw in on-premises Microsoft SharePoint Server that lets an unauthorized attacker run code over a network. CISA says it bypasses the earlier fix for CVE-2025-49704, and it is part of the chain publicly reported as ToolShell.

Which SharePoint versions are affected by CVE-2025-53770?

NVD lists SharePoint Server Subscription Edition, 2016 and 2019 as affected. Microsoft's fixed builds are 16.0.18526.20508 for Subscription Edition, 16.0.10417.20037 for 2019 and 16.0.5513.1001 for 2016.

Is CVE-2025-53770 exploited in the wild?

Yes. Microsoft stated an exploit exists in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on 20 July 2025. CISA's alert says actors were seen encrypting files and distributing Warlock ransomware.

How do I protect SharePoint from CVE-2025-53770?

Install Microsoft's security update for your version and turn on AMSI with endpoint protection. CISA also says to rotate the ASP.NET machine keys and restart IIS, and to disconnect public-facing servers that cannot be protected.

In our research

  1. KEV due-date windows and pace of additions October 2026
  2. Exploited vulnerabilities in 2025: what ENISA reports October 2026
  3. Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using June 2026
  4. Warlock Group: The Rise of GOLD SALEM (Storm-2603) in the Ransomware Landscape March 2026

Sources

  1. CVE-2025-53770 security update guide data Microsoft Security Response Center
  2. Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities CISA
  3. NVD entry CVE-2025-53770 NIST National Vulnerability Database
  4. Known Exploited Vulnerabilities catalog CISA

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more