CVE-2025-53771

What it actually does

CVE-2025-53771 is an improper authentication weakness in Microsoft Office SharePoint that can allow an unauthenticated network attacker to spoof trusted SharePoint requests or identity/context assumptions. The flaw is most concerning when exposed SharePoint servers accept crafted HTTP requests that bypass or confuse expected authentication checks. By itself the assigned impact is spoofing, but public reporting associates this issue with the ToolShell exploitation activity, where SharePoint authentication and request-handling weaknesses were chained with other flaws to gain deeper access. The vulnerability is weaponized and has an extremely high EPSS score, indicating a high likelihood of exploitation attempts against internet-facing systems.

Why it matters to the business

Successful exploitation can let an attacker abuse SharePoint trust boundaries, potentially enabling unauthorized access paths, follow-on compromise, data exposure, service disruption, or persistence if chained with additional vulnerabilities. SharePoint commonly stores sensitive business documents, workflows, and collaboration data, so compromise can affect legal, financial, operational, and intellectual-property information. Although it is not listed in CISA KEV and is not specifically marked as ransomware-associated, the weaponized status, ToolShell association, and very high EPSS score make this a high-priority issue for any organization running externally reachable SharePoint infrastructure.

How an attack unfolds

An attacker first identifies a reachable Microsoft Office SharePoint instance and determines whether it is likely unpatched. They then send crafted HTTP requests to SharePoint endpoints that exercise the improper authentication behavior, causing the server to treat the request as more trusted than it should be. In observed ToolShell-related activity, attackers used SharePoint-facing web endpoints as the initial entry point and chained authentication/request validation weaknesses with additional exploit logic to achieve stronger outcomes such as arbitrary server-side actions or deployment of web-accessible payloads. After gaining a foothold, an attacker may enumerate SharePoint configuration and content, access documents, harvest credentials or tokens available to the application context, deploy web shells, and move laterally from the SharePoint server into adjacent infrastructure.

How to fix it

Apply the latest Microsoft security updates for the affected SharePoint product line as soon as possible. No exact fixed versions were provided in the input, so administrators should consult Microsoft’s official update guidance for CVE-2025-53771 and install the current cumulative/security update for each supported SharePoint version in use. Prioritize internet-facing SharePoint servers, then internal SharePoint farms. If immediate patching is not possible, reduce exposure by restricting SharePoint access to trusted networks or VPN, placing the service behind strong authentication and web application firewall controls, disabling unnecessary public access, and monitoring/blocking suspicious requests to SharePoint layout and ToolPane-related endpoints. Because this issue is associated with weaponized ToolShell activity, treat unpatched externally reachable servers as potentially targeted and perform compromise assessment before and after patching.

How to confirm the fix worked

Confirm that all SharePoint servers in each farm have the applicable Microsoft security update installed and that farm build numbers match Microsoft’s patched build guidance. Verify that no externally reachable SharePoint server remains on an unpatched build. From an exposure perspective, confirm that SharePoint administrative and application endpoints are not broadly reachable from the internet unless explicitly required. Review HTTP access logs, SharePoint ULS logs, Windows event logs, IIS logs, and endpoint telemetry for historical requests to suspicious SharePoint layout endpoints, unexpected ASPX files in SharePoint web directories, and web server worker processes spawning command interpreters. If a web application firewall or reverse proxy is in front of SharePoint, validate that it logs and blocks known ToolShell-style request patterns where possible without breaking legitimate traffic.

Typical attack path

1. Scan the internet or target network for exposed Microsoft Office SharePoint servers.
2. Fingerprint SharePoint version, patch level, and reachable application endpoints.
3. Send crafted unauthenticated HTTP requests that trigger the improper authentication/spoofing behavior.
4. Abuse the spoofed trust context directly or chain it with another SharePoint vulnerability to perform privileged server-side actions.
5. Access SharePoint content, configuration, or application secrets available to the compromised context.
6. Optionally deploy persistence such as an ASPX web shell under SharePoint-accessible directories.
7. Use the SharePoint server as a pivot point for credential theft, internal reconnaissance, and lateral movement.

How to detect it

To determine whether exploitation already occurred, review IIS web access logs, SharePoint ULS logs, reverse proxy logs, WAF logs, Windows Security logs, PowerShell logs, and EDR process/file telemetry for suspicious SharePoint endpoint access and post-exploitation behavior. Focus on unauthenticated or unusual requests to SharePoint layout pages, especially ToolPane-related endpoints, odd Referer or Source parameters, unexpected POST requests, and requests followed by server errors or new file creation. On hosts, search for unexpected ASPX files in SharePoint directories, particularly under Microsoft Shared\Web Server Extensions\15 or 16\TEMPLATE\LAYOUTS. Investigate any instance where the IIS worker process w3wp.exe launches command shells, scripting engines, compilers, download tools, or living-off-the-land binaries. Review for file writes shortly after suspicious HTTP requests, anomalous authentication events, new local users, scheduled tasks, service creation, credential dumping indicators, and outbound connections from SharePoint servers to unfamiliar IPs or domains. If ToolShell threat activity is suspected, correlate HTTP requests to layout endpoints with creation or execution of ASPX payloads and subsequent process execution under the SharePoint application pool identity.

• /_layouts/15/ToolPane.aspx
• ToolPane.aspx?DisplayMode=Edit
• /_layouts/SignOut.aspx?Source=
• Referer: /_layouts/SignOut.aspx
• POST /_layouts/15/ToolPane.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\spinstall0.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\*.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\*.aspx
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> csc.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> bitsadmin.exe
• /ToolPane.aspx
• DisplayMode=Edit

What your security team should do

• Immediately inventory all Microsoft Office SharePoint servers, especially internet-facing systems.
• Patch all affected SharePoint servers with the latest Microsoft security updates; prioritize externally reachable servers first.
• Because the vulnerability is weaponized and has an EPSS score near 1.0, run compromise assessment even if no outage or alert has occurred.
• Search IIS, SharePoint ULS, proxy, WAF, EDR, and SIEM logs for ToolShell-style requests and suspicious SharePoint web shell artifacts.
• Hunt for unexpected ASPX files under SharePoint TEMPLATE\LAYOUTS and web root directories.
• Investigate any w3wp.exe child processes such as cmd.exe, powershell.exe, csc.exe, msbuild.exe, certutil.exe, or rundll32.exe.
• Restrict external access to SharePoint where business requirements allow; require VPN, conditional access, or other strong access controls.
• Rotate credentials, service account secrets, and application secrets if exploitation or web shell activity is suspected.
• Preserve forensic evidence before rebuilding or cleaning compromised SharePoint servers.
• Add WAF/SIEM detections for suspicious requests to /_layouts/15/ToolPane.aspx, spoofed Referer/Source patterns, and unexpected POST activity to SharePoint layout endpoints.