CVE-2025-53770: Microsoft SharePoint Server On-Premises "ToolShell" RCE

CVE-2025-53770 is a deserialization-of-untrusted-data flaw (CWE-502) in on-premises Microsoft SharePoint Server that allows a remote, unauthenticated attacker to execute code over the network, and it was exploited worldwide in July 2025 — dubbed "ToolShell" — before Microsoft had a comprehensive patch ready.

CVE-2025-53770 is a deserialization of untrusted data vulnerability (CWE-502) affecting on-premises Microsoft SharePoint Server. NVD's record states the flaw "allows an unauthorized attacker to execute code over a network" and explicitly notes that at disclosure time, "Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild," with a comprehensive fix still being prepared and tested — organizations were told to rely on interim mitigation guidance rather than a finished patch (NVD).

Scoring provenance matters here. The only CVSS v3.1 score on record is a Secondary metric submitted by Microsoft's own CNA (source [email protected]): 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability. As of this writing, NVD has not published its own Primary analysis/score for this CVE, so the 9.8 figure should be read as Microsoft's assessment, not an independently NVD-confirmed rating (NVD).

CISA added CVE-2025-53770 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-07-20, with an unusually tight required-action due date of 2025-07-21 — a one-day turnaround reflecting active, widespread exploitation at the time of listing. The KEV entry records known ransomware campaign use and directs federal agencies and asset owners to disconnect any public-facing SharePoint Server that has reached end-of-life or end-of-service (explicitly calling out SharePoint Server 2013 and earlier), and otherwise to follow CISA and vendor mitigation guidance or discontinue use if no mitigation is available (CISA KEV).

The exploitation wave was publicly tracked under the name "ToolShell" and hit on-premises SharePoint Server deployments globally within days of disclosure; security researchers and press coverage linked to from the NVD record describe mass scanning and compromise across sectors before organizations could apply fixes (NVD references: Ars Technica, eye.security). CISA's own alert on the incident ties CVE-2025-53770 to a related patch-bypass chain, describing it as a bypass of the fix for CVE-2025-49704 — a separate but connected SharePoint RCE issue (also related in the same chain to CVE-2025-49706 and its own bypass, CVE-2025-53771). This advisory covers CVE-2025-53770 specifically; the related CVEs are distinct issues and are not detailed here (CISA Alert).

Affected configurations recorded by NVD include SharePoint Server Subscription Edition builds prior to 16.0.18526.20508, SharePoint Server 2016 (Enterprise), and SharePoint Server 2019; NVD's configuration data does not give a precise build-level range for the 2016 and 2019 listings, so administrators should confirm patch status against Microsoft's own update guide rather than a specific version window here (NVD; MSRC Update Guide).

FIRST's EPSS model currently scores the probability of exploitation at 0.99999 (99.991th percentile) as of 2026-10-30 — essentially the ceiling of the scale, consistent with a vulnerability that saw immediate, mass, real-world exploitation and remains a top scanning target well over a year after disclosure (FIRST EPSS).

Given the KEV listing, known ransomware use, and nearly-maximal EPSS score, any internet-facing on-premises SharePoint Server should be treated as a priority: apply Microsoft's current security updates, rotate ASP.NET machine keys before and after patching and restart IIS, deploy AV/EDR on SharePoint servers, hunt for signs of prior compromise (including suspicious .dll payloads and referrer headers such as /_layouts/SignOut.aspx), and disconnect any end-of-life SharePoint instance (2013 or earlier) from the internet entirely (CISA Alert; MSRC Customer Guidance).

• Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized, unauthenticated attacker to execute code over the network; Microsoft confirmed an in-the-wild exploit existed at disclosure while a comprehensive fix was still being finalized. — NVD
• CVSS v3.1 base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, submitted as a Secondary metric by Microsoft's CNA ([email protected]); NVD has not published its own Primary score for this CVE. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-07-20 with a due date of 2025-07-21, known ransomware campaign use, and a required action to disconnect end-of-life/end-of-service SharePoint Server (2013 and earlier) and follow mitigation guidance for supported versions. — CISA KEV
• Affected configurations: SharePoint Server Subscription Edition prior to build 16.0.18526.20508, SharePoint Server 2016 (Enterprise), and SharePoint Server 2019 (precise build ranges for 2016/2019 not specified in NVD configuration data). — NVD
• The exploitation campaign is tracked publicly as "ToolShell"; CVE-2025-53770 functions as a patch bypass for CVE-2025-49704, part of a related SharePoint RCE/spoofing chain also including CVE-2025-49706 and CVE-2025-53771. — CISA Alert
• EPSS score is 0.99999 (99.991th percentile) as of 2026-10-30. — FIRST EPSS
• Recommended mitigations include rotating ASP.NET machine keys before and after patching, restarting IIS, deploying AV/EDR, and hunting for signs of compromise such as suspicious .dll payloads and SignOut.aspx referrer headers. — CISA Alert