CVE-2025-53770
📋 TL;DR
CVE-2025-53770 is a critical deserialization vulnerability in on-premises Microsoft SharePoint Server that allows unauthenticated attackers to execute arbitrary code remotely. This affects organizations running vulnerable SharePoint Server instances, particularly those exposed to untrusted networks. Microsoft has confirmed active exploitation in the wild.
💻 Affected Systems
- Microsoft SharePoint Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the SharePoint server leading to domain takeover, data exfiltration, ransomware deployment, and lateral movement across the network.
Likely Case
Unauthorized remote code execution leading to data theft, credential harvesting, and installation of backdoors or malware.
If Mitigated
Limited impact with proper network segmentation, application controls, and monitoring in place to detect and block exploitation attempts.
🎯 Exploit Status
Microsoft confirms active exploitation in the wild. Public proof-of-concept code is available on GitHub, making exploitation trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not yet released
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
Restart Required: Yes
Instructions:
1. Monitor Microsoft Security Response Center for patch release. 2. Test patch in non-production environment. 3. Apply patch to all affected SharePoint servers during maintenance window. 4. Restart servers as required.
🔧 Temporary Workarounds
Block SharePoint web services
windowsTemporarily block access to SharePoint web services endpoints that handle deserialization to prevent exploitation.
Use firewall rules to block inbound traffic to SharePoint web services ports (typically 443 for HTTPS)
Implement network segmentation
allIsolate SharePoint servers from untrusted networks and restrict access to authorized IP addresses only.
Configure firewall ACLs to allow only trusted IP ranges to SharePoint servers
🧯 If You Can't Patch
- Immediately isolate SharePoint servers from internet and untrusted networks using firewall rules
- Implement application control to block execution of unauthorized binaries and scripts on SharePoint servers
🔍 How to Verify
Check if Vulnerable:
Check if running on-premises SharePoint Server. If yes, assume vulnerable until patched.Check Version:
Get-SPFarm | Select BuildVersion (PowerShell on SharePoint server)Verify Fix Applied:
After patch installation, verify SharePoint Server version matches patched version from Microsoft advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation events from w3wp.exe (SharePoint worker process)
- Suspicious deserialization errors in SharePoint ULS logs
- Failed authentication attempts followed by successful requests
Network Indicators:
- Unusual outbound connections from SharePoint servers
- HTTP requests to SharePoint web services from unexpected source IPs
- Traffic patterns indicating data exfiltration
SIEM Query:
source="SharePoint" AND (event_id=5002 OR event_id=6398 OR "Deserialization" OR "w3wp.exe" AND process_create)🔗 References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
- https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/
- https://github.com/kaizensecurity/CVE-2025-53770
- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- https://news.ycombinator.com/item?id=44629710
- https://research.eye.security/sharepoint-under-siege/
- https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally
- https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/
- https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
- https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw
- https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/
- https://x.com/Shadowserver/status/1946900837306868163
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770
