Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2025-53770)

What is affected, what to do

This vulnerability involves deserialization of untrusted data in Microsoft SharePoint Server, allowing an unauthorized attacker to execute code over the network. It is actively exploited in ransomware campaigns. Affected products include specific versions of Microsoft SharePoint Server, notably version 16.0.18526.20508. Immediate implementation of the provided mitigations is crucial until a comprehensive update is fully tested and released, offering more robust protection than previous patches.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Microsoft SharePoint Enterprise Server 2016 to version 16.0.5513.1001, Microsoft SharePoint Server 2019 to version 16.0.10417.20037, Microsoft SharePoint Server Subscription Edition to version 16.0.18526.20508. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft SharePoint Enterprise Server 2016 lt 16.0.0..16.0.5513.1001
• Microsoft SharePoint Server 2019 lt 16.0.0..16.0.10417.20037
• Microsoft SharePoint Server Subscription Edition lt 16.0.0..16.0.18526.20508

Fixed in

• Microsoft SharePoint Enterprise Server 2016 16.0.5513.1001
• Microsoft SharePoint Server 2019 16.0.10417.20037
• Microsoft SharePoint Server Subscription Edition 16.0.18526.20508

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Scope the exposure: Inventory every on-premises SharePoint Server instance (Subscription Edition, 2019, 2016), and prioritise anything reachable from the internet on 443/TCP or 80/TCP. SharePoint Online (Microsoft 365) is not affected.
   • Apply the security update: Microsoft has shipped updates that harden beyond the bypassed CVE-2025-49704 fix. The patch is available from the vendor — look up the KB number for each product version in the MSRC advisory for CVE-2025-53770. Deploy the CVE-2025-53771 updates in the same window, because the two are chained.
   • If you cannot patch today, enable AMSI: Turn on SharePoint AMSI integration (Full Mode where available) with Defender Antivirus or an AMSI-capable EDR on every SharePoint server. If that isn't possible, pull the servers off the internet until patched.
   • Rotate the ASP.NET machine keys: After patching or mitigating, rotate them using Update-SPMachineKey or the "Machine Key Rotation" timer job, then run iisreset.exe on every farm server. Stolen ValidationKeys otherwise let attackers forge signed malicious ViewState payloads, even against patched hosts.
   • Hunt before you close the ticket: Check ...\Web Server Extensions\16\TEMPLATE\LAYOUTS\ (and 15\) for unknown .aspx files, notably spinstall0.aspx and variants. On a hit, invoke incident response, isolate the server and preserve forensic images.
   • Regulatory clock: If compromise is confirmed, prepare the NIS2 early warning to your CSIRT/BSI within 24 h. Ransomware linkage makes this a likely significant incident.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Do not expose SharePoint front-ends directly. Gate access through VPN, ZTNA or a pre-authenticating reverse proxy. Restrict egress from SharePoint servers to the destinations they actually need (default-deny outbound).
   • WAF/IPS: Block requests to /_layouts/15/ToolPane.aspx or /_layouts/16/ToolPane.aspx that carry DisplayMode=Edit or a Referer containing /_layouts/SignOut.aspx. This is the CVE-2025-53771 auth-bypass pattern. Also enable vendor Suricata/Snort signatures for "ToolShell" / CVE-2025-53770.
   • Endpoint hardening: Enforce AMSI integration and real-time protection. Enable the Defender for Endpoint ASR rules that block process creation from web server processes, and stop w3wp.exe from spawning cmd.exe, powershell.exe or csc.exe.
   • File integrity: Put FIM on TEMPLATE\LAYOUTS and web.config. Where operationally feasible, remove write access for the app pool identity on those paths.
   • IAM/least privilege: Farm and app pool service accounts must not hold domain admin rights. After any suspected compromise, rotate their passwords and every secret reachable from SharePoint (connection strings, stored credentials).
3. 03

   Runbook step 3

   Detection rules

   • IIS access logs: Look for a POST to ToolPane.aspx with cs(Referer) set to /_layouts/SignOut.aspx, followed by a GET to /_layouts/15/spinstall0.aspx. SPL: index=iis cs_uri_stem="*ToolPane.aspx" cs_method=POST cs_Referer="*SignOut.aspx*"
   • Sysmon EID 1 / Windows EID 4688: Watch for the process chain w3wp.exe → cmd.exe → powershell.exe with -EncodedCommand or -enc. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "w3wp.exe" and FileName in~ ("cmd.exe","powershell.exe") and ProcessCommandLine has_any ("-enc","EncodedCommand")
   • Sysmon EID 11: Alert when w3wp.exe or one of its children writes an .aspx file under \TEMPLATE\LAYOUTS\. Sigma shape: Image|endswith: '\w3wp.exe' AND TargetFilename|contains: '\LAYOUTS\' AND TargetFilename|endswith: '.aspx'.
   • Key theft: Flag any reference to System.Web.Configuration.MachineKeySection, ValidationKey or DecryptionKey in PowerShell Script Block Logging (EID 4104) or in webshell responses.
   • AMSI/Defender alerts: Escalate immediately on detections such as "Exploit:Script/SuspSignoutReq" or "Trojan:Win32/HijackSharePointServer", and on any AMSI block raised in the context of w3wp.exe.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Source: CSA/SingCERT, NCSC NZ (CC BY 4.0), pwn.watch, certeu_advisory, Microsoft Security Update Guide, CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Sharepoint Enterprise Server 2016
• Microsoft Microsoft Sharepoint Server 2019
• Microsoft Microsoft Sharepoint Server Subscription Edition
• Microsoft Microsoft SharePoint Server Subscription Edition

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• Microsoft Security Update GuideMicrosoft SharePoint Server Remote Code Execution VulnerabilityVendor advisory, Patch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770government-resource
• Microsoft Security Update Guideblog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve…
• cisa.govnews-events/alerts/2025/07/20/microsoft-releases-guidance-explo…
• research.eye.securitySharePoint Under Siege: ToolShell Exploitpwn-watch
• bleepingcomputer.comnews/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-a…
• forbes.comsites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sh…
• x.comShadowserver/status/1946900837306868163
• github.comkaizensecurity/CVE-2025-53770
• therecord.mediamicrosoft-sharepoint-zero-day-vulnerability-exploited-globally
• news.ycombinator.comitem?id=44629710
• arstechnica.comsecurity/2025/07/sharepoint-vulnerability-with-9-8-severity-rat…
• darkreading.comremote-workforce/microsoft-rushes-emergency-fix-exploited-share…
• cert.atCERT.at: Kritische Sicherheitslücke in Microsoft SharePoint - aktiv ausgenützt, Updates verfügbarcert-at
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2025-ALE-010 – [MàJ] Multiples vulnérabilités dans Microsoft SharePoint (clôturée 2025-08-26)cert-fr
• pwn.watchpwn.watch: ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)pwn-watch
• microsoft.comCustomer guidance for SharePoint vulnerability CVE-2025-53770pwn-watch
• microsoft.comDisrupting active exploitation of on-premises SharePoint vulnerabilitiespwn-watch
• cisa.govUPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilitiespwn-watch
• enisa.europa.euJoint Statement on SharePoint vulnerabilitiespwn-watch