Microsoft · SharePoint
Microsoft SharePoint Server (on-premises) contains a deserialization of untrusted data flaw. An unauthenticated attacker with network access can exploit it to execute code, with no user interaction or special configuration required.
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
First seen exploited 2 days before it was disclosed. Public exploit code (Metasploit) was available 12 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This deserialization vulnerability in Microsoft SharePoint allows an unauthenticated remote attacker to execute remote code on the network.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2025-53770 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Correct CVEs Referenced: The vulnerabilities exploited during the July 17–19 seem not to be CVE-2025-53770/53771, but rather the original ToolShell chain: CVE-2025-49706 (auth bypass) and CVE-2025-49704 (deserialization RCE).
4 passages name itOriginal (opens in a new tab) ↗
The immediate, high-severity threat posed by the easily exploitable CVE- 2025-53770 vulnerability prompted our team to proactively investigate its…
4 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.