CVE-2025-53770

What it actually does

CVE-2025-53770 is a critical deserialization-of-untrusted-data vulnerability in on-premises Microsoft SharePoint Server that allows an unauthenticated remote attacker to execute arbitrary code over the network. Successful exploitation can give the attacker code execution in the SharePoint web application context, enabling web shell deployment, command execution through IIS worker processes, access to SharePoint content and configuration, credential or machine-key theft, and lateral movement into adjacent Windows infrastructure.

Why it matters to the business

A compromised on-premises SharePoint server can expose sensitive documents, internal collaboration data, authentication material, and business workflows. Because this issue is known to be actively exploited, is listed in CISA KEV, has an extremely high EPSS score, and is associated with ransomware activity, unpatched internet-facing SharePoint servers should be treated as high-likelihood compromise candidates. The CISA remediation deadline of 2025-07-21 has passed, so delayed remediation materially increases the risk of data theft, operational disruption, extortion, and ransomware deployment.

How an attack unfolds

An attacker identifies an exposed on-premises SharePoint Server and sends crafted HTTP requests that trigger unsafe deserialization in a vulnerable SharePoint component. The malicious serialized data causes SharePoint to execute attacker-controlled code without requiring valid credentials. In observed ToolShell-related exploitation, attackers have used SharePoint application endpoints to gain code execution, write ASPX web shells into SharePoint-accessible directories, and then interact with those web shells to run operating-system commands. After initial execution, the attacker may enumerate the server, extract configuration secrets such as ASP.NET machine keys or SharePoint credentials, dump files, stage tooling, disable defenses, and pivot into the Windows domain. Because this vulnerability has been used in ransomware campaigns, post-exploitation activity may progress from reconnaissance and persistence to data exfiltration and encryption.

How to fix it

Apply Microsoft’s official SharePoint Server security updates and follow the current Microsoft CVE guidance for CVE-2025-53770. Where a comprehensive update is not yet applied, ensure Microsoft’s documented mitigation for this CVE is in place immediately. Prioritize all internet-facing on-premises SharePoint servers. Enable and verify SharePoint AMSI integration where supported, run Microsoft Defender Antivirus or another capable antimalware engine with current signatures, and restrict external access to SharePoint until patched if exposure cannot be remediated quickly. After patching, rotate ASP.NET machine keys and any potentially exposed SharePoint secrets, recycle IIS, and review for web shells or unauthorized file modifications because patching alone does not remove existing compromise. If compromise is suspected, isolate the server, preserve forensic evidence, rebuild from trusted media if necessary, and reset credentials or keys that may have been accessible to the SharePoint application pool.

How to confirm the fix worked

Confirm that all on-premises SharePoint servers have the latest applicable Microsoft security updates installed and that Microsoft’s mitigation for this CVE is enabled where required. Validate that SharePoint build numbers match Microsoft’s patched guidance for the deployed SharePoint version. Check that AMSI integration is enabled and functioning, antimalware is active, IIS has been restarted after remediation, and ASP.NET machine keys have been rotated where Microsoft recommends doing so. From an exposure perspective, verify that unauthenticated access from the internet is not available unless explicitly required and protected. From a compromise perspective, inspect SharePoint web directories for unexpected ASPX files, review IIS logs for suspicious ToolPane or web-shell requests, and confirm that w3wp.exe has not spawned command interpreters or scripting tools.

Typical attack path

1. Scan the internet or target ranges for exposed on-premises Microsoft SharePoint Server instances.
2. Send crafted unauthenticated HTTP requests to vulnerable SharePoint endpoints to trigger unsafe deserialization.
3. Achieve remote code execution in the SharePoint/IIS application context.
4. Drop or modify an ASPX web shell under a SharePoint web-accessible directory.
5. Use the web shell to run commands through w3wp.exe, cmd.exe, or powershell.exe.
6. Collect SharePoint configuration files, machine keys, credentials, tokens, and sensitive document repositories.
7. Deploy additional tooling for persistence, credential theft, lateral movement, or data exfiltration.
8. In ransomware-motivated intrusions, use the compromised server as an entry point for broader encryption or extortion operations.

How to detect it

Review IIS logs for suspicious unauthenticated POST requests to SharePoint application endpoints, especially ToolShell-associated access patterns such as requests to /_layouts/15/ToolPane.aspx and subsequent access to newly created ASPX files. Inspect SharePoint ULS logs for deserialization, unexpected application errors, file-write activity, or abnormal page compilation events around the time of suspicious HTTP requests. On the host, review Windows Security Event ID 4688, Sysmon process creation events, EDR telemetry, and PowerShell logs for w3wp.exe launching command interpreters, scripting engines, download utilities, or archive tools. Search the SharePoint installation tree for recently created or modified ASPX files, particularly under TEMPLATE\LAYOUTS directories. Review file creation events, antivirus detections, and web server access logs for known ToolShell web-shell naming patterns such as spinstall0.aspx. Also look for access to web.config or other configuration files, machine-key discovery, credential dumping activity, outbound connections from the SharePoint server to unfamiliar IPs, and staged tools in temporary directories. Because this vulnerability is associated with active exploitation and ransomware campaigns, correlate any SharePoint exploitation indicators with later signs of lateral movement, remote service creation, scheduled tasks, data staging, and mass file modification.

• /_layouts/15/ToolPane.aspx
• /_layouts/SignOut.aspx
• spinstall0.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\spinstall0.aspx
• C:\PROGRA~1\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx
• C:\PROGRA~1\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\spinstall0.aspx
• w3wp.exe
• cmd.exe
• powershell.exe
• certutil.exe
• bitsadmin.exe
• mshta.exe
• rundll32.exe
• web.config
• machineKey

What your security team should do

• Treat all vulnerable, internet-facing on-premises SharePoint servers as emergency remediation targets because exploitation is active in the wild and ransomware-linked.
• Apply Microsoft’s official security updates or mitigations immediately; the KEV deadline has passed.
• If the server was exposed before remediation, perform threat hunting rather than assuming patching alone is sufficient.
• Search for ASPX web shells, especially unexpected files under SharePoint LAYOUTS and TEMPLATE paths.
• Review IIS, SharePoint ULS, Windows Security, PowerShell, Sysmon/EDR, and antimalware logs for exploitation and post-exploitation activity.
• Hunt for w3wp.exe spawning cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, mshta.exe, rundll32.exe, or other living-off-the-land tools.
• Rotate ASP.NET machine keys, SharePoint service account credentials, and other secrets that may have been readable by the SharePoint process.
• Restrict inbound access to SharePoint management and application endpoints with VPN, reverse proxy controls, IP allowlists, and WAF monitoring where feasible.
• If web shells or attacker commands are found, isolate affected servers and initiate incident response, including domain credential review and lateral movement investigation.