CVE-2025-53770
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePointApplications & CMS
CVSS
9.8CriticalExploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. CISA KEV
What fixes it
- 16.0.5513.1001Microsoft SharePoint Enterprise Server 2016CVE List
- 16.0.10417.20037Microsoft SharePoint Server 2019CVE List
- 16.0.18526.20508Microsoft SharePoint Server Subscription EditionCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 8 Jul 2025Exploit code publicMetasploit
- 20 Jul 2025, 01:06 UTCPublishedCVE List
- 20 Jul 2025Added to CISA KEVCISA KEV
Public exploit code and templates 3
- Exploit moduleMicrosoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) 8 Jul 2025Metasploit
- Remote exploitMicrosoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE) 11 Aug 2025Exploit-DB
- Scanner templateMicrosoft SharePoint Server - Remote Code Execution (ToolShell)Nuclei
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Description
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Text from CVE List
Affected versions 3
- Microsoft SharePoint Enterprise Server 2016affected: 16.0.0 before 16.0.5513.1001CVE List
- Microsoft SharePoint Server 2019affected: 16.0.0 before 16.0.10417.20037CVE List
- Microsoft SharePoint Server Subscription Editionaffected: 16.0.0 before 16.0.18526.20508CVE List
References 15
- msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770Fixvia CVE List
- microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/Advisoryvia CISA KEV
- research.eye.security/sharepoint-under-siege/Advisoryvia CVE List
- github.com/kaizensecurity/CVE-2025-53770Advisoryvia CVE List
- arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/Advisoryvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2025-53770Referencevia CISA KEV
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770Referencevia CVE List
- msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/Referencevia CVE List
- cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770Referencevia CVE List
- bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/Referencevia CVE List
- forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/Referencevia CVE List
- x.com/Shadowserver/status/1946900837306868163Referencevia CVE List
- therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globallyReferencevia CVE List
- news.ycombinator.com/item?id=44629710Referencevia CVE List
- darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flawReferencevia CVE List