Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)

Kyaw_Myo_Oo — Sun, 20 Jul 2025 18:48:09 GMT

Dear All,

CISA is aware of active exploitation of a new remote code execution (RCE) vulnerability enabling unauthorized access to on-premise SharePoint servers. While the scope and impact continue to be assessed, the new Common Vulnerabilities and Exposures (CVE), CVE-2025-53770, is a variant of the existing vulnerability CVE-2025-49706 and poses a risk to organizations. This exploitation activity, publicly reported as “ToolShell,” provides unauthenticated access to systems and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network.

https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770

https://research.eye.security/sharepoint-under-siege/

https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-07-19-Microsoft-SharePoint-vulnerabilities-CVE-2025-49704-and-49706.txt

It's always great to learn from each other, share experiences, and stay updated. Let's learn and explore together!

Re: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)

Caute_cautim — Sun, 20 Jul 2025 20:21:34 GMT

@Kyaw_Myo_Oo the motto about not putting all your eggs into the same basket is also relevant too.

Regards

Caute_cautim

topic Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770) in Industry News

Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)

Re: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)