Search/CVE-2025-53770
● CVE — Critical

CVE-2025-53770

VendormicrosoftProductsharepoint serverDiscoveredJul 20, 2025UpdatedAug 4, 2026

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

CVSS v3.1
9.8 CRITICAL
EPSS
99.9%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
87
sources referencing this CVE
Related IOCs
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▲ 0.02pp
99.9% → 99.9% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
100 relationships
Timeline
disclosure → media coverage
Jul 20, 2025
Disclosure — published as a CVE record. · last revised by NVD Aug 4, 2026
Jul 21, 2025
crowdstrike.com reports: CrowdStrike Detects and Blocks Initial SharePoint Zero-Day Exploitation
Jul 21, 2025
acn.gov.it reports: ToolShell: rilevato sfruttamento in rete di vulnerabilità in SharePoint
Jul 21, 2025
kaspersky.com reports: Update Microsoft SharePoint ASAP | Kaspersky official blog
Jul 21, 2025
krebsonsecurity.com reports: Microsoft Fix Targets Attacks on SharePoint Zero-Day
Jul 21, 2025
news.sophos.com reports: SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild
Jul 21, 2025
research.checkpoint.com reports: 21st July – Threat Intelligence Report
Jul 22, 2025
thehackernews.com reports: Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
Jul 22, 2025
redhotcyber.com reports: La nuova ondata su Microsoft SharePoint Server miete vittime: oltre 100 organizzazioni colpite
Jul 22, 2025
bleepingcomputer.com reports: Microsoft links Sharepoint attacks to Chinese hacking groups
Jul 22, 2025
cybersecurity360.it reports: Attacchi a SharePoint: hacker collegati alla Cina sfruttano la falla ToolShell
Jul 22, 2025
infosecurity-magazine.com reports: SharePoint 'ToolShell' Vulnerabilities Exploited by Chinese Nation-State Hackers
Jul 23, 2025
thehackernews.com reports: CISA Orders Urgent Patching After Chinese Hackers Exploit SharePoint Flaws in Live Attacks
Jul 23, 2025
bleepingcomputer.com reports: US nuclear weapons agency hacked in Microsoft SharePoint attacks
Jul 23, 2025
isc.sans.edu reports: Analyzing Sharepoint Exploits (CVE-2025-53770, CVE-2025-53771), (Wed, Jul 23rd)
Jul 24, 2025
redhotcyber.com reports: ToolShell: La Vulnerabilità zero-day in Microsoft SharePoint è sotto attacco da inizio di luglio
Jul 24, 2025
welivesecurity.com reports: ToolShell: An all-you-can-eat buffet for threat actors
Jul 24, 2025
bleepingcomputer.com reports: Microsoft: SharePoint servers also targeted in ransomware attacks
Jul 24, 2025
thehackernews.com reports: Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems
Jul 24, 2025
infosecurity-magazine.com reports: Ransomware Deployed in Compromised SharePoint Servers
Jul 24, 2025
therecord.media reports: Microsoft says Warlock ransomware deployed in SharePoint attacks as governments scramble
Jul 25, 2025
securelist.com reports: ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Jul 25, 2025
welivesecurity.com reports: SharePoint under fire: ToolShell attacks hit organizations worldwide
Jul 25, 2025
cybersecurity360.it reports: Gli attacchi a SharePoint confermano la necessità di protezioni crittografiche forti
Jul 28, 2025
schneier.com reports: Microsoft SharePoint Zero-Day
Jul 28, 2025
thehackernews.com reports: ⚡ Weekly Recap — SharePoint Breach, Spyware, IoT Hijacks, DPRK Fraud, Crypto Drains and More
Jul 30, 2025
infosecurity-magazine.com reports: US Tops Hit List as 396 SharePoint Systems Compromised Globally
Jul 31, 2025
welivesecurity.com reports: This month in security with Tony Anscombe – July 2025 edition
Jul 31, 2025
research.checkpoint.com reports: Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
Aug 1, 2025
thehackernews.com reports: Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
Aug 1, 2025
acn.gov.it reports: Ricostruzione di una catena di attacco post-compromissione di SharePoint
Aug 4, 2025
bsi.bund.de reports: Version 1.2: Microsoft SharePoint - Massive Ausnutzung einer Zero-Day Schwachstelle
Aug 4, 2025
research.checkpoint.com reports: 4th August – Threat Intelligence Report
Aug 4, 2025
bleepingcomputer.com reports: Ransomware gangs join attacks targeting Microsoft SharePoint servers
Aug 5, 2025
isc.sans.edu reports: Stealing Machine Keys for fun and profit (or riding the SharePoint wave), (Tue, Aug 5th)
Aug 5, 2025
bleepingcomputer.com reports: The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
Aug 6, 2025
redhotcyber.com reports: Con ToolShell, è possibile accedere alle Machine key di Internet information Services (IIS)
Aug 7, 2025
thehackernews.com reports: Microsoft Discloses Exchange Server Flaw Enabling Silent Cloud Access in Hybrid Setups
Aug 8, 2025
helpnetsecurity.com reports: August 2025 Patch Tuesday forecast: Try, try again
Aug 13, 2025
securityweek.com reports: Microsoft Patches Over 100 Vulnerabilities
Aug 13, 2025
helpnetsecurity.com reports: Microsoft fixes “BadSuccessor” Kerberos vulnerability (CVE-2025-53779)
Aug 13, 2025
helpnetsecurity.com reports: Croatian research institute confirms ransomware attack via ToolShell vulnerabilities
Aug 14, 2025
bleepingcomputer.com reports: Canada’s House of Commons investigating data breach after cyberattack
Aug 17, 2025
helpnetsecurity.com reports: Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw
Aug 18, 2025
infosecurity-magazine.com reports: Colt Customers Face Prolonged Outages After Major Cyber Incident
Aug 20, 2025
infosecurity-magazine.com reports: Warlock Ransomware Hitting Victims Globally Through SharePoint ToolShell Exploit
Aug 21, 2025
infosecurity-magazine.com reports: Orange Data Breach Raises SIM-Swapping Attack Fears
Aug 21, 2025
infosecurity-magazine.com reports: Colt Admits Customer Data Likely Stolen in Cyber-Attack
Aug 22, 2025
securityweek.com reports: In Other News: McDonald’s Hack, 1,200 Arrested in Africa, DaVita Breach Grows to 2.7M
Sep 9, 2025
securityweek.com reports: Microsoft Patches 86 Vulnerabilities
Sep 10, 2025
intezer.com reports: Frankenstein Variant of the ToneShell Backdoor Targeting Myanmar
Oct 11, 2025
thehackernews.com reports: Hackers Turn Velociraptor DFIR Tool Into Weapon in LockBit Ransomware Attacks
Oct 15, 2025
securityweek.com reports: F5 Says Nation-State Hackers Stole Source Code and Vulnerability Data
Oct 22, 2025
bleepingcomputer.com reports: Sharepoint ToolShell attacks targeted orgs across four continents
Oct 22, 2025
thehackernews.com reports: Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch
Oct 22, 2025
therecord.media reports: ToolShell bug used by Chinese attackers against governments in Africa, South America
Oct 24, 2025
infosecurity-magazine.com reports: Threat Actors Ramp Up Public App Exploits as ToolShell Gains Traction
Oct 24, 2025
securityweek.com reports: In Other News: iOS 26 Deletes Spyware Evidence, Shadow Escape Attack, Cyber Exec Sold Secrets to Russia
Nov 19, 2025
infosecurity-magazine.com reports: Half of Ransomware Access Due to Hijacked VPN Credentials
Nov 19, 2025
securelist.com reports: IT threat evolution in Q3 2025. Non-mobile statistics
Nov 22, 2025
thehackernews.com reports: Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks
Dec 1, 2025
isc.sans.edu reports: [Guest Diary] Hunting for SharePoint In-Memory ToolShell Payloads, (Tue, Dec 2nd)
Dec 2, 2025
helpnetsecurity.com reports: How a noisy ransomware intrusion exposed a long-term espionage foothold
Dec 3, 2025
securelist.com reports: Exploits and vulnerabilities in Q3 2025
Dec 8, 2025
research.checkpoint.com reports: 8th December – Threat Intelligence Report
Dec 16, 2025
research.checkpoint.com reports: Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
Dec 17, 2025
thehackernews.com reports: China-Linked Ink Dragon Hacks Governments Using ShadowPad and FINALDRAFT Malware
Jan 1, 2026
bleepingcomputer.com reports: The biggest cybersecurity and cyberattack stories of 2025
Feb 9, 2026
thehackernews.com reports: SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers
Feb 10, 2026
helpnetsecurity.com reports: Unpatched SolarWinds WHD instances under active attack
Feb 23, 2026
research.checkpoint.com reports: 2025: The Untold Stories of Check Point Research
Mar 2, 2026
research.checkpoint.com reports: 2nd March – Threat Intelligence Report
Mar 3, 2026
research.checkpoint.com reports: Silver Dragon Targets Organizations in Southeast Asia and Europe
Mar 10, 2026
thehackernews.com reports: The Zero-Day Scramble is Avoidable: A Guide to Attack Surface Reduction
Mar 19, 2026
securityweek.com reports: CISA Warns of Attacks Exploiting Recent SharePoint Vulnerability
Mar 23, 2026
securityweek.com reports: M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds
May 8, 2026
kaspersky.com reports: The Evolution of Kaspersky SIEM | Kaspersky official blog
Jul 14, 2026
thehackernews.com reports: Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Jul 15, 2026
cybersecurity360.it reports: Patch Tuesday, il record che nessuno voleva: 622 CVE e un nuovo modo di fare sicurezza
Aug 26, 2026
securelist.com reports: Exploits and vulnerabilities in Q2 2026
Sep 22, 2026
thehackernews.com reports: SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
Oct 2, 2026
securityweek.com reports: Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Oct 2, 2026
therecord.media reports: 'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
Oct 2, 2026
bleepingcomputer.com reports: Warlock ransomware breach SharePoint in water, telecom operator attacks
Oct 3, 2026
thehackernews.com reports: Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Oct 5, 2026
research.checkpoint.com reports: 5th October – Threat Intelligence Report
Oct 6, 2026
bleepingcomputer.com reports: How to secure RMM software: 8 controls MSPs should test
Oct 22, 2026
securelist.com reports: How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia