CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
- Record
CVE-2025-53770- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2025-23309
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
- Record
EUVD-2025-23309- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xcrc-8vqv-vc8r
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an...
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
- Record
GHSA-xcrc-8vqv-vc8r- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CISA KEV No score
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
- Record
CVE-2025-53770- Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
- Record
CVE-2025-53770- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | 2025-07-08 |
| PoC in GitHub | Bluefire-Redteam-Cybersecurity/bluefire-sharepoint-cve-2025-53770 | 2025-07-21 |
| PoC in GitHub | RukshanaAlikhan/CVE-2025-53770 | 2025-07-21 |
| PoC in GitHub | ZephrFish/CVE-2025-53770-Scanner | 2025-07-21 |
| PoC in GitHub | gmh5225/ZeroPoint | 2025-07-21 |
| PoC in GitHub | grupooruss/CVE-2025-53770-Checker | 2025-07-21 |
| PoC in GitHub | hazcod/CVE-2025-53770 | 2025-07-21 |
| PoC in GitHub | kaizensecurity/CVE-2025-53770 | 2025-07-21 |
| PoC in GitHub | paolokappa/SharePointSecurityMonitor | 2025-07-21 |
| PoC in GitHub | soltanali0/CVE-2025-53770-Exploit | 2025-07-21 |
Show 18 moreShow less
Plus 20 more. The full list has every link.
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| exploits, exploits_more | ||
| exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-53770 is a critical vulnerability (CVSS 9.8) in Microsoft Sharepoint, published July 20, 2025. CISA lists it as known to be exploited, since July 20, 2025. EUVD reports exploitation since July 20, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770
research.eye.security/sharepoint-under-siege
bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available
Show 9 moreShow less
forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available
x.com/Shadowserver/status/1946900837306868163
github.com/kaizensecurity/CVE-2025-53770
therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally
news.ycombinator.com/item?id=44629710
arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe
darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw
nvd.nist.gov/vuln/detail/CVE-2025-53770