SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know

Detect and mitigate CVE-2025-53770 and CVE-2025-53771 - critical vulnerabilities in Microsoft SharePoint Server currently under active exploitation.

Microsoft has issued urgentguidancefollowing the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.

CVE-2025-53770(CVSS 9.8) is a critical RCE vulnerability caused byunsafe deserializationof untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.

CVE-2025-53771(CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.

These vulnerabilities arechained togetherin an exploit known as ToolShell:

CVE-2025-53771 enables unauthenticated access (auth bypass).

CVE-2025-53770 enables the attacker to execute code (RCE).

Importantly, these are not brand-new bugs, but variants of earlier vulnerabilities:

CVE-2025-53770 is a bypass of the fix for CVE-2025-49704 (original deserialization/RCE).

CVE-2025-53771 is a bypass of the fix for CVE-2025-49706 (original spoofing bug).

Although MicrosoftpatchedCVE-2025-49704 and CVE-2025-49706 in the July 2025 Patch Tuesday release, threat actors recently found new paths to exploit the same core logic, prompting Microsoft to assign new CVEs and release emergency fixes.

In many reported cases, it remains unclear whether observed in-the-wild exploitation reflects abuse of the original CVEs or their bypasses.

These flaws affect on-premises SharePoint servers only and are not applicable to Microsoft 365 SharePoint Online.

The vulnerabilities apply exclusively to on-premises deployments of Microsoft SharePoint Server. This includes servers running on physical hosts as well as self-managed SharePoint instances running in the cloud.

The impacted SharePoint versions are:

SharePoint Server Subscription Edition - earlier than KB5002768

SharePoint Server 2019 - earlier than 16.0.10417.20027 / KB5002754

SharePoint Server 2016

While SharePoint Server 2010 and 2013 have reached end-of-life and are therefore no longer supported, they are still noted by Microsoft as affected.

According to Microsoft, SharePoint Online in Microsoft 365 is NOT impacted.

While SharePoint Online (Microsoft 365) is not affected, self-managed SharePoint Server instances hosted in the cloud (e.g., on Azure, AWS, or GCP) are vulnerable.

According to Wiz data,9%of cloud environments have resources running vulnerable versions of self-managed SharePoint.

While active exploitation of on-premises Microsoft SharePoint servers using the ToolShell exploit chain has been observed since July 18, 2025, the groundwork for this attack began much earlier- starting with vulnerability disclosures and proof-of-concept demonstrations months prior.

May 2025- AtPwn2Own Berlin, security researchers from Viettel Cyber Security demonstrated a chained exploit targeting on-premises SharePoint. This exploit combined CVE-2025-49704 (unsafe deserialization) and CVE-2025-49706 (path traversal/spoofing) to achieve unauthenticated remote code execution (RCE). The exploit chain was dubbed ToolShell.

July 9, 2025 (Patch Tuesday)- Microsoft issued fixes for CVE-2025-49704 and CVE-2025-49706. These were believed to fully address the ToolShell chain.

July 14, 2025–Security researchers from CODE WHITE GmbHpublicly reproducedthe original ToolShell exploit.

July 18, 2025-Eye Securityidentified active exploitation of SharePoint servers in the wild using 0-day bypasses for the original ToolShell vulnerabilities. This marked the first known in-the-wild abuse of the exploit chain. A second wave of attacks was observed on July 19th.

July 20, 2025- Microsoft acknowledged the attacks and issued an official advisory, assigning CVE-2025-53770 (new unsafe deserialization RCE) and CVE-2025-53771 (server spoofing vulnerability) to the bypass variants. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities (KEV) catalog on the same day.

July 21, 2025- Microsoft released emergency patches for SharePoint Server Subscription Edition and SharePoint Server 2019, fully mitigating the new ToolShell bypasses.

Initial Entry (CVE-2025-53771):The attacker sends a POST request to/_layouts/15/ToolPane.aspx?DisplayMode=Editusing a crafted Referer header (/_layouts/SignOut.aspx) to bypass authentication. This leverages a header spoofing vulnerability that makes SharePoint treat the request as authenticated.

Payload Delivery (CVE-2025-53770):With authenticated access to the vulnerableToolPane.aspxendpoint, the attacker exploits an insecure deserialization vulnerability by submitting a malicious payload in the POST body. SharePoint deserializes attacker-controlled data without validation, leading to the execution of embedded commands. This results in dropping a stealthy ASPX web shell (e.g.,spinstall0.aspx) into a directory such as:C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\.  This web shell grants persistent remote access to the server.

Key Extraction:The uploaded web shell is used to extract sensitive cryptographic material, including theValidationKeyandDecryptionKeyfrom the server’smachineKeyconfiguration. These keys are critical for forging valid, signed ASP.NET ViewState payloads that SharePoint will trust.

Remote Code Execution:Using tools likeysoserial, the attacker crafts malicious__VIEWSTATEpayloads signed with the stolen keys. Because SharePoint trusts the signature, it deserializes and executes the embedded payloads. This enables unauthenticated remote code execution, even after the initial foothold - completing the attack chain.

File name:spinstall0.aspx

SHA256 hash:92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514

Referer:/_layouts/SignOut.aspx

POST to/_layouts/15/ToolPane.aspx?DisplayMode=Edit

GET request to/_layouts/15/spinstall0.aspx

Process name:w3wp.exespawning encoded PowerShell

IP addresses:107.191.58[.]76,104.238.159[.]149,96.9.125[.]147,103.186.30[.]186

File path:C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS\spinstall0.aspx

Apply the latest SharePoint security updates:

SharePoint Server Subscription Edition (KB5002768)

SharePoint Server 2019 (KB5002754)

Monitor for SharePoint Server 2016 patch availability

Older unsupported versions (2010, 2013) are considered exposed and should be isolated or upgraded

If patching is not possible immediately, take these steps as a workaround solution:

Disconnect internet-facing SharePoint servers if patches or AMSI can’t be applied

Enable AMSI in Full Mode

Rotate ASP.NET Machine Keys after patching or enabling AMSI:

Use PowerShell (Update-SPMachineKey) or run the job in Central Admin

Restart IIS withiisreset.exe

Assume compromise if the server was exposed to the internet:

Isolate/shut down the server

Revoke credentials and rotate secrets

Engage incident response teams

Audit and reduce layout/admin privileges

Monitor for Indicators of Compromise (IOCs).

Wiz customers can use the prebuilt queries available in theWiz Threat Intel Centerto determine if they have been impacted by these vulnerabilities:

Identify vulnerable SharePoint instances

Track Internet exposure of at-risk servers

Detect indicators of compromise

Microsoft Customer Guidance

Eye Security - SharePoint 0-day uncovered (CVE-2025-53770)

HackerNews - Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks

CISA - Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)

SOCRadar - ToolShell Campaign: New SharePoint Zero-Day (CVE-2025-53770) Triggers Widespread Exploitation

See how Wiz protects your cloud from code to runtime

New critical vulnerability with 9.0 CVSS presents systemic risk to the AI ecosystem, carries widespread implications for AI infrastructure.

Improve security posture and remediate risks faster using natural language workflows.

What our customers say: Wiz named as a Gartner Customers’ Choice for CSPM

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings