CVE-2025-53770

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS 9.8 CRITICALEPSS 100.0%● KEVCWE-502

In short

Microsoft SharePoint Server has a critical flaw where it processes untrusted data in a way that allows attackers to run malicious code remotely without authorization. This is a severe security issue because it can be exploited over the internet to take full control of affected servers.

Technical detail

CVE-2025-53770 is an unsafe deserialization vulnerability (CWE-502) in on-premises Microsoft SharePoint Server that permits unauthenticated remote code execution. Attackers can exploit this by sending specially crafted network requests containing malicious serialized objects; the server deserializes untrusted input without proper validation, leading to arbitrary code execution with server privileges. Active exploitation has been reported in the wild.

Summary generated and translated by AI from the official description.

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C

Affected products

Microsoft · Microsoft SharePoint Enterprise Server 2016 Microsoft · Microsoft SharePoint Server 2019 Microsoft · Microsoft SharePoint Server Subscription Edition

public PoCs found — 45

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/https://github.com/kaizensecurity/CVE-2025-53770 https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 https://news.ycombinator.com/item?id=44629710 https://research.eye.security/sharepoint-under-siege/https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770 https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/