CVE-2025-53770
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-53770. We'll provide specific mitigation strategies based on your environment and risk profile.
CVSS Score
V3.1Attack Vector Metrics
Impact Metrics
Description
No description available
Available Exploits
Related News
A critical zero-day vulnerability in Microsoft SharePoint, tracked as CVE-2025-53770, is under active exploitation in the wild. The vulnerability, with a CVSS score of 9.8, impacts on-premises SharePoint Server 2016, 2019, and Subscription Edition, and allows…
A few days after the exploit originally became widely known, there are now many different SharePoint exploit attempts in circulation. We do see some scans by researchers to identify vulnerable systems (or to scan for common artifacts of compromise), and a few…
The post Metasploit Module Released for Actively Exploited Microsoft SharePoint Flaw CVE-2025-53770 appeared first on Daily CyberSecurity.
Microsoft disclosed two critical vulnerabilities, CVE-2025-53771 and CVE-2025-53770, that are exploited to attack SharePoint servers. Possession of these cryptographic machine keys allows an attacker to forge authentication tokens and maintain access even if …
Security researchers at Google and Microsoft say they have evidence that hackers backed by China are exploiting a zero-day bug in Microsoft SharePoint, as companies around the world scramble to patch the flaw. The bug, known officially as CVE-2025-53770 and d…
Affected Products
Affected Versions:
Affected Versions:
Affected Versions:
Known Exploited Vulnerability
This vulnerability is actively being exploited in the wild
Remediation Status
Due Date
Added to KEV
Required Action
CISA recommends configuring AMSI integration in SharePoint and deploying Defender AV on all SharePoint servers. If AMSI cannot be enabled, CISA recommends disconnecting affected products that are public-facing on the internet from service until official mitigations are available. Once mitigations are provided, apply them according to CISA and vendor instructions. Follow the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Affected Product
Ransomware Risk
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Advisory provided by GitHub Security Advisory Database. Published: July 20, 2025, Modified: July 22, 2025
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
Help: Issues after Patching for CVE-2025-53770 Hey guys. I'm super new to SharePoint, I'm a developer that does nothing related to Ms SharePoint but as we now have a smaller IT workforce at the company I work for, I was assigned as owner of these servers on Monday (worst possible …
SharePoint “ToolShell” zero day If SharePoint “ToolShell” zero day is ruining your day, we've got you covered. CVE-2025-53770 and CVE-2025-53771 don't have to get in the way of your detection and hunting activities.
[New Builder Templates] Address Endpoint CVE-2025-47981 & SharePoint CVE-2025-53770 This week brought serious new security vulnerabilities, including one affecting general endpoint security (CVE-2025-47981) and another specifically targeting SharePoint servers (CVE-2025-53770). Both are already being actively exploited. To help our community respond quickly, we've released two new Recast Builder automation templates …
Serious Security Flaw: Metasploit Module Targets Active SharePoint Exploits **New Metasploit module exposes critical zero-day vulnerabilities in Microsoft SharePoint Server, allowing unauthenticated remote code execution.** **Key Points:** - SharePoint vulnerabilities (CVE-2025-53770/53771) exploited through a simple HTTP request. - Unauthenticated remote code execution on SharePoint 2019 with SYSTEM privileges. - Immediate …
Impact of CVE-2025-53770 on workflows? After patching our SharePoint servers per Microsoft's guidance, at least one Sp2010 workflow action is no longer working. Specifically, "copy list item." When attempting to publish a workflow with this action, I get "Unexpected error on server associating the workflow." Workflows that already have the …
Critical Zero-Day in Microsoft SharePoint Enables Unauthenticated Remote Code Execution CVE-2025-53770 (CVSS 9.8) is a critical zero-day vulnerability affecting **on-premises Microsoft SharePoint Server**. It is a variant of CVE-2025-49704 and stems from unsafe deserialization of untrusted data, allowing **unauthenticated remote code execution** over the network. Attackers exploit this flaw to …
🔥 Top 10 Trending CVEs (24/07/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2024-4947](https://nvd.nist.gov/vuln/detail/CVE-2024-4947)** - 📝 Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security …
Patching SharePoint servers to make sure your infrastructure isn't vulnerable to #ToolShell (CVE-2025-53770) is half the job. The other half is... ... validating that mitigations actually worked across your entire environment. Our Network Scanner provides immediate, targeted, and FAST detection for this 🔴 critical, unauthenticated RCE vulnerability: ✅ instantly scan …
SharePoint Zero-Day (CVE-2025-53770) — What Your Patch Won’t Fix TL;DR: A SharePoint zero-day lets attackers in and stay in even after patching. If you rely on centralized infrastructure, it’s time to rethink how you protect and recover your data. A new SharePoint zero-day (CVE-2025-53770) was disclosed last week. It allows …
Microsoft bleibt stabil - diesmal Sharepoint > CISA Orders Urgent Patching After Chinese Hackers Exploit SharePoint Flaws in Live Attacks > CVE-2025-49704 – SharePoint Remote Code Execution CVE-2025-49706 – SharePoint Post-auth Remote Code Execution CVE-2025-53770 – SharePoint ToolShell Authentication Bypass and Remote Code Execution CVE-2025-53771 – SharePoint ToolShell Path Traversal