Two critical SharePoint vulnerabilities—CVE-2025-53770 and CVE-2025-53771—are currently being exploited in the wild. These zero-day flaws have already affected hundreds of organizations, including high-profile government agencies. If your organization runs an on-premises SharePoint server, it’s time to take immediate action.
What’s Happening?
In July 2025, Microsoft and security researchers disclosed a pair of vulnerabilities that attackers are chaining together to gain remote access to unpatched SharePoint servers. The threat actor is deploying a backdoor tool known as ToolShell, allowing them to maintain persistent access and potentially move laterally within the environment.
Here’s what each vulnerability does:
| CVE ID | Type | What It Allows |
|---|---|---|
| CVE-2025-53771 | Authentication Spoofing | Lets attackers bypass authentication by forging an HTTP referer header |
| CVE-2025-53770 | Remote Code Execution (RCE) | Allows execution of malicious code on the server without valid credentials |
Together, these two vulnerabilities open the door to serious compromise, even on systems that were previously patched for earlier issues.
Sources:
Who’s Behind the Attacks?
According to Microsoft and independent researchers, the exploits have been linked to multiple Chinese state-sponsored hacking groups, including:
- Storm-2603
- Violet Typhoon
- Linen Typhoon
So far, more than 400 organizations have been affected globally—including critical infrastructure, healthcare systems, and U.S. government agencies like the National Nuclear Security Administration.
Source:
How the Attack Works
- Initial Access
Attackers send a POST request toToolPane.aspx, faking the referer header. This bypasses SharePoint’s authentication process (CVE-2025-53771). - Payload Deployment
They then upload a specially crafted.aspxfile, which is deserialized by the server and used to execute arbitrary code (CVE-2025-53770). - Persistence via ToolShell
The malware installs a web shell (e.g.,spinstall0.aspx) in the SharePoint LAYOUTS directory and extracts machineKey values, allowing attackers to maintain access.
How to Protect Your Environment
If your SharePoint server is internet-facing and hasn’t been patched since mid-July 2025, assume it’s vulnerable—or already compromised.
Immediate Steps to Take:
| Action | Description |
|---|---|
| 1. Patch Now | Apply Microsoft’s July 2025 security updates for SharePoint Server 2016, 2019, or Subscription Edition. |
| 2. Rotate Machine Keys | Replace ASP.NET machineKey values to invalidate potential attacker tokens. |
| 3. Restart IIS | Force recycling of cached authentication values. |
| 4. Hunt for Indicators | Look for suspicious .aspx files (e.g. spinstall0.aspx) in LAYOUTS, ViewState anomalies, or odd ToolPane.aspx activity. |
| 5. Turn on Defender & AMSI | Enable Microsoft Defender Antivirus and AMSI (Antimalware Scan Interface) in Full Mode to block further payloads. |
Resources:
Is SharePoint Online Affected?
No. These vulnerabilities only impact on-premises versions of SharePoint Server. Microsoft 365 and SharePoint Online are not vulnerable to this particular attack chain.
Our Recommendation
If you’re running SharePoint Server and haven’t yet patched or assessed your systems, now is the time. The current campaign is active and effective—and remediation is not optional.
At Forestal Security, we offer:
- SharePoint vulnerability assessments
- Patch and key rotation support
- Threat hunting for Toolshell and web shell indicators
- SharePoint hardening and Microsoft Defender integration
Need Help Fast?
We offer same-day SharePoint audits and support. Contact us for a free consultation:
Frequently Asked Questions about SharePoint Vulnerabilities
What is CVE-2025-53770 in SharePoint?
CVE-2025-53770 is a remote code execution vulnerability affecting Microsoft SharePoint Server 2016, 2019, and Subscription Edition. It allows attackers to execute arbitrary code without authentication by exploiting unsafe deserialization.
How are CVE-2025-53770 and CVE-2025-53771 related?
These two vulnerabilities are used in tandem. CVE-2025-53771 enables authentication spoofing, while CVE-2025-53770 allows code execution. When chained, they provide unauthenticated attackers full access to SharePoint servers.
What is Toolshell malware?
Toolshell is a persistent web shell used by attackers after exploiting SharePoint vulnerabilities. It’s often installed in the LAYOUTS directory and enables long-term unauthorized access and command execution.
Is SharePoint Online vulnerable?
No. SharePoint Online, part of Microsoft 365, is not affected by CVE-2025-53770 or CVE-2025-53771. These issues are limited to on-premises versions of SharePoint Server.
How do I check if my SharePoint Server is compromised?
Review server logs for POST requests to ToolPane.aspx, scan for unauthorized .aspx files like spinstall0.aspx in the LAYOUTS directory, and inspect ViewState activity. Antivirus and endpoint detection tools can help verify compromise.
How can I fix these SharePoint vulnerabilities?
Apply Microsoft’s July 2025 patches, rotate machine keys in web.config, restart IIS, and enable advanced threat detection. Monitor for signs of exploitation and unauthorized access.
Which SharePoint versions are vulnerable?
CVE-2025-53770 and CVE-2025-53771 affect SharePoint Server 2016, 2019, and Subscription Edition. SharePoint Online is not impacted.
