Cybercriminals are actively exploiting a critical vulnerability in Microsoft SharePoint Server that allows remote code execution without authentication or user interaction.
The flaw, registered as CVE-2025-53770, received a CVSS score of 9.8 and impacts on-premises installations of the collaboration platform. It arises from unsafe deserialization of specially crafted data submitted to the server, enabling attackers to run arbitrary commands and fully compromise the system.
The exploitation is part of an attack chain known as ToolShell, which also involves the vulnerabilities CVE-2025-49704 and CVE-2025-49706. The issues CVE-2025-53770 and CVE-2025-53771 emerged as variants specifically designed to circumvent previously applied protections.
Affected products include SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. The cloud-based SharePoint Online service offered through Microsoft 365 is not impacted.
After gaining initial access, threat actors can deploy web shells, run additional tools, and exfiltrate cryptographic keys from ASP.NET. These keys allow attackers to forge valid authentication tokens and retain access even after security updates are installed.
Administrators are advised to deploy all available patches without delay, limit internet exposure of SharePoint servers, and search for suspicious files, processes, and scheduled tasks that may indicate compromise.
