SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know
Essential information
- Published
- 21/07/2025 22:45
- Modified
- 22/07/2025 09:30
- Tags
- 2025-07-21 CVE-2025-53770 CVE-2025-53771 authentication bypass deserialization on-premises patch rce sharepoint spoofing toolshell zero-day
- Related entities
- 5 vulnerabilities (cve), 3 observables, 7 techniques (mitre), 1 malware
Description
Two critical zero-day vulnerabilities, CVE-2025-53770 and CVE-2025-53771, are actively exploited in on-premises Microsoft SharePoint servers. These flaws enable unauthenticated remote code execution through an exploit chain dubbed ToolShell. CVE-2025-53770 is a critical RCE vulnerability caused by unsafe deserialization, while CVE-2025-53771 is a spoofing vulnerability allowing authentication bypass. The vulnerabilities affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Cloud-hosted self-managed SharePoint instances are also at risk. Exploitation has been observed since July 18, 2025, with attacks targeting sensitive data extraction and persistent remote access. Microsoft has released emergency patches, and organizations are urged to update immediately or implement workarounds if patching is not possible.