by Kastro
Paper/Archive/CVE-2025-53770

CVE-2025-53770

Microsoft Microsoft SharePoint Enterprise Server 2016 — Microsoft SharePoint Server Remote Code Execution Vulnerability

KEV · due 21 Julransomware useEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Affected

ProductAffectedFixed inSource
Microsoft SharePoint Enterprise Server 201616.0.0 – < 16.0.5513.100116.0.5513.1001CNA
Microsoft SharePoint Server 201916.0.0 – < 16.0.10417.2003716.0.10417.20037CNA
Microsoft SharePoint Server Subscription Edition16.0.0 – < 16.0.18526.2050816.0.18526.20508CNA

Scores by source

microsoft (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770refmsrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770refcisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770refresearch.eye.security/sharepoint-under-siegerefbleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-availablerefforbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-availablerefx.com/Shadowserver/status/1946900837306868163refgithub.com/kaizensecurity/CVE-2025-53770reftherecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globallyrefnews.ycombinator.com/item?id=44629710refarstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globerefdarkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flawkevcisa.gov/known-exploited-vulnerabilities-catalog