CRITICAL

CVE-2025-53770

Microsoft Sharepoint Server 2025-07-20 CVSS v3.1

CVSS

9.8

KEV

Description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Summary dbcve.org

A deserialization vulnerability in on-premises Microsoft SharePoint Server allows unauthenticated remote attackers to execute arbitrary code by sending specially crafted requests. The vulnerability has a CVSS score of 9.8 (Critical) and active exploits are known to exist in the wild.

Mitigation

Implement the mitigation referenced in Microsoft's CVE documentation while awaiting the comprehensive security update; typical mitigations for deserialization vulnerabilities include network segmentation, restricting unnecessary network exposure, and implementing Web Application Firewall rules.

Proof of Concept

Weakness (CWE)

CWE-502 Deserialization of Untrusted Data

EPSS Score

100%

Probability of exploitation in next 30 days

100th percentile

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 Vendor Advisory https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/ Exploit, Press/Media Coverage https://github.com/kaizensecurity/CVE-2025-53770 Exploit https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ Mitigation, Vendor Advisory https://news.ycombinator.com/item?id=44629710 Issue Tracking https://research.eye.security/sharepoint-under-siege/ Exploit, Mitigation, Third Party Advisory https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally Press/Media Coverage https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/ Press/Media Coverage https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 Mailing List, Third Party Advisory, US Government Resource https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw Press/Media Coverage https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/ Press/Media Coverage https://x.com/Shadowserver/status/1946900837306868163 Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE