{"id":"CVE-2025-53770","published":"2025-07-20T01:15:30Z","modified":"2026-08-04T05:16:34Z","title":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","vendor":"Microsoft","product":"SharePoint","tier":"core","eol":null,"description":{"text":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.\nMicrosoft is aware that an exploit for CVE-2025-53770 exists in the wild.\nMicrosoft is preparing and fully testing a comprehensive update to address this vulnerability.  In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.","provenance":"source","from":"NVD"},"summary":{"text":"Microsoft SharePoint Server (on-premises) contains a deserialization of untrusted data flaw. An unauthenticated attacker with network access can exploit it to execute code, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99991,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-07-20","dueDate":"2025-07-21","ransomware":true,"requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53770","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-07-18","exploitedFirstSeen":"2025-07-18","ransomware":true,"evidence":[{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-18"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Jul","date":"2025-07-19"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2025-07-19"},{"url":"https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/","date":"2025-07-19"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770","date":"2025-07-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-07-20"},{"url":"https://x.com/Shadowserver/status/1946900837306868163","date":"2025-07-20"},{"url":"https://blog.checkpoint.com/research/sharepoint-zero-day-cve-2025-53770-actively-exploited-what-security-teams-need-to-know/","date":"2025-07-21"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities","date":"2025-07-21"},{"url":"https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/","date":"2025-07-21"}],"evidenceTotal":232,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770","tags":["Vendor Advisory"]},{"url":"https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/","tags":["Exploit","Press/Media Coverage"]},{"url":"https://github.com/kaizensecurity/CVE-2025-53770","tags":["Exploit"]},{"url":"https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/","tags":["Mitigation","Vendor Advisory"]},{"url":"https://news.ycombinator.com/item?id=44629710","tags":["Issue Tracking"]},{"url":"https://research.eye.security/sharepoint-under-siege/","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally","tags":["Press/Media Coverage"]},{"url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/","tags":["Press/Media Coverage"]},{"url":"https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770","tags":["Mailing List","Third Party Advisory","US Government Resource"]},{"url":"https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw","tags":["Press/Media Coverage"]},{"url":"https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/","tags":["Press/Media Coverage"]},{"url":"https://x.com/Shadowserver/status/1946900837306868163","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Deserialization of Untrusted Data","mappingType":"exploitation_technique","evidence":[],"comment":"This deserialization vulnerability in Microsoft SharePoint allows an unauthenticated remote attacker to execute remote code on the network.","confidence":"high"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Deserialization of Untrusted Data","mappingType":"exploitation_technique","evidence":[],"comment":"This deserialization vulnerability in Microsoft SharePoint allows an unauthenticated remote attacker to execute remote code on the network.","confidence":"high"}],"reports":[{"id":"SRC-e7dfbcdaedcbed88ea81","title":"SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Research SharePoint 0-day uncovered (CVE-2025-53770)","publisher":"research.eye.security","url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-19","mentions":[{"quote":"Correct CVEs Referenced: The vulnerabilities exploited during the July 17–19 seem not to be CVE-2025-53770/53771, but rather the original ToolShell chain: CVE-2025-49706 (auth bypass) and CVE-2025-49704 (deserialization RCE).","start":1669,"end":1894},{"quote":"Removed Unverified PoCs: We removed links to speculative GitHub PoCs for CVE-2025-53770 that could not be validated and may have contributed to confusion.","start":2719,"end":2873},{"quote":"Patch Clarifications: CVE-2025-53770 and CVE-2025-53771","start":16824,"end":16879},{"quote":"About 24 hours after we published our initial findings and contacted affected vendors, the Microsoft Security Response Center (MSRC) released an out-of-band advisory addressing two new CVEs: CVE-2025-53770 (a patch bypass of CVE-2025-49704) and CVE-2025-53771 (a bypass of CVE-2025-49706).","start":16883,"end":17172},{"quote":"We strongly advise you to follow Microsoft Customer guidance for SharePoint vulnerability CVE-2025-53770.","start":20633,"end":20738}]},{"id":"SRC-9d530a0a481837d1886d","title":"Trellix SecondSight Threat Hunting Report, Feb 2026","publisher":"trellix.com","url":"https://www.trellix.com/assets/threat-reports/secondsight-threat-report-feb-2026.pdf","date":null,"mentions":[{"quote":"CVE-2025-53770.","start":6341,"end":6356},{"quote":"CVE-2025-53770 & COBALT STRIKE C2 INFRASTRUCTURE","start":7083,"end":7131},{"quote":"(CVE-2025-53770) targeting financial, healthcare, and life science","start":7227,"end":7293},{"quote":"The immediate, high-severity threat posed by the easily exploitable CVE-\r\n2025-53770 vulnerability prompted our team to proactively investigate its","start":8855,"end":9002},{"quote":"Organizations should immediately patch CVE-2025-53770 and rotate","start":9943,"end":10007}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-23309","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23309","exploited":true,"exploitedSince":"2025-07-20","provenance":"source"},"exploits":[{"id":52405,"url":"https://www.exploit-db.com/exploits/52405","title":"Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)","type":"remote","platform":"windows","date":"2025-08-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-08-11"},"pocGithub":{"count":38,"skipped":7,"earliest":"2025-07-21","earliestUrl":"https://github.com/RukshanaAlikhan/CVE-2025-53770","repos":[{"name":"soltanali0/CVE-2025-53770-Exploit","url":"https://github.com/soltanali0/CVE-2025-53770-Exploit","stars":316,"created":"2025-07-21"},{"name":"MuhammadWaseem29/CVE-2025-53770","url":"https://github.com/MuhammadWaseem29/CVE-2025-53770","stars":57,"created":"2025-07-22"},{"name":"hazcod/CVE-2025-53770","url":"https://github.com/hazcod/CVE-2025-53770","stars":45,"created":"2025-07-21"},{"name":"kaizensecurity/CVE-2025-53770","url":"https://github.com/kaizensecurity/CVE-2025-53770","stars":44,"created":"2025-07-21"},{"name":"ZephrFish/CVE-2025-53770-Scanner","url":"https://github.com/ZephrFish/CVE-2025-53770-Scanner","stars":18,"created":"2025-07-21"}]},"metasploit":[{"name":"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)","module":"exploit/windows/http/sharepoint_toolpane_rce","type":"exploit","disclosureDate":"2025-07-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"}],"nuclei":[{"id":"CVE-2025-53770","name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","severity":"critical","path":"http/cves/2025/CVE-2025-53770.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53770.yaml"}],"first":{"date":"2025-07-08","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create","id":"ba479447-721f-42a9-9af2-6dcd517bbdb3","level":"critical","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml","techniques":["T1190"]},{"title":"Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators","id":"7477881c-ec3b-49d6-aced-7255944e5c59","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-53770/proc_creation_win_exploit_cve_2025_53770_indicators.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/proc_creation_win_exploit_cve_2025_53770_indicators.yml","techniques":["T1190"]},{"title":"SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS","id":"48d053db-6a56-4866-b60d-0975647050ed","level":"medium","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml","techniques":["T1190"]}]},"exploitRefs":["https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/","https://github.com/kaizensecurity/CVE-2025-53770","https://research.eye.security/sharepoint-under-siege/"],"flow":[{"stage":"exploitation","techniques":["T1190","T1059"],"provenance":"source"}],"timeline":[{"date":"2025-07-08","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-07-21, Exploit-DB 2025-08-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb","provenance":"source"},{"date":"2025-07-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://research.eye.security/sharepoint-under-siege/","provenance":"source"},{"date":"2025-07-19","kind":"report","label":"Named in research.eye.security: SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Resea…","url":"https://research.eye.security/sharepoint-under-siege/","provenance":"machine"},{"date":"2025-07-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53770","provenance":"source"},{"date":"2025-07-20","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23309","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":86.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 470 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 38 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-sharepoint-cwe-502"}}