InfoSecBulletin Cybersecurity for mankind
Microsoft issued urgent updates for two serious SharePoint security holes, identified as CVE-2025-53770 and CVE-2025-53771, used in attacks known as “ToolShell.”
Both vulnerabilities exclusively affect on-premises SharePoint Servers, allowing threat actors to exploit them for unauthenticated, remote code execution.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Microsoft has announced that the SharePoint vulnerability CVE-2025-53770, with a CVSS score of 9.8, is currently being exploited.
The vulnerability in on-premises Microsoft SharePoint Server allows unauthorized attackers to exploit deserialization of untrusted data to execute code remotely. Viettel Cyber Security found this flaw through Trend Micro’s ZDI.
“Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.” reads the advisory. “Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.”
Microsoft suggests enabling AMSI integration and using Microsoft Defender for all SharePoint Server farms to protect against a new vulnerability.
Microsoft announces that vulnerability CVE-2025-53770 is related to spoofing issue CVE-2025-49706 (CVSS score: 6).3), which the IT giant addressed with the release of July 2025 Patch Tuesday updates. The company is developing a full patch and confirmed that the bug affects only on-premises SharePoint servers, not SharePoint Online in Microsoft 365.
“Microsoft is aware of active attacks targeting on-premises SharePoint Server customers. The attacks are exploiting a variant of CVE-2025-49706. This vulnerability has been assigned CVE-2025-53770.” reads the advisory published by Microsoft. “SharePoint Online in Microsoft 365 is not impacted. “A patch is currently not available for this vulnerability. Mitigations and detections are provided below.”
Attackers use a SharePoint vulnerability to execute commands before authentication by misusing object deserialization. They use stolen machine keys to persist and move laterally, making detection difficult without deep endpoint visibility.
Security researchers from Eye Security and Palo Alto Networks warned of attacks combining two SharePoint flaws, CVE-2025-49706 and CVE-2025-49704, in a chain called “ToolShell.”
However, given that CVE-2025-53770 is a variant of CVE-2025-49706, the attacks are likely related.
“On the evening of July 18, 2025, Eye Security identified active, large-scale exploitation of a new SharePoint remote code execution (RCE) vulnerability chain, dubbed ToolShell, demonstrated just days ago on X, this exploit is being used in the wild to compromise on-premise SharePoint servers across the world. The new chain we elaborate in this blog, was later named CVE-2025-53770 by Microsoft.” reads the analysis published by Eye Security. “Our team scanned 8000+ SharePoint servers worldwide. We discovered dozens of systems actively compromised, probably on 18th of July around 18:00 UTC and 19th of July around 07:30 UTC. This blog will share our detailed findings and recommendations to patch & perform a compromise assessment if you think you are affected.”
The IT giant resolved a SharePoint spoofing flaw, CVE-2025-53771 (CVSS 6.3), due to improper path restrictions. An anonymous researcher reported it. Microsoft also connected this bug to CVE-2025-49704 and CVE-2025-49706, which attackers can combine with CVE-2025-53770 for remote code execution.
“Improper limitation of a pathname to a restricted directory (‘path traversal’) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.” reads the advisory. “Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.”
