CVE-2025-53770KEV · OVERDUECWE-502insecure-deserialization

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Critical · published July 20, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.

458
days past CISA
deadline
CVSS v3.1
9.8
EPSS
100%
Percentile
100.0
In the wild
Confirmed
What it is

🚨 A crafty deserialization flaw in Microsoft SharePoint Server could let unauthorized attackers execute code remotely — it's a happening party for cybercriminals! 🔥 Think of it like a buffet where the hosts accidentally left the door wide open. Anyone can stroll in, grab whatever they please, and cause chaos without any invitation. If exploited, this vulnerability could allow attackers to run arbitrary code, potentially compromising sensitive data or taking complete control of the SharePoint server. That’s a full-scale invasion of your digital space, and it could lead to devastating data breaches or system crashes. 🚨

Put simply

Think of it like a buffet where the hosts accidentally left the door wide open. Anyone can stroll in, grab whatever they please, and cause chaos without any invitation. This critical vulnerability arises from deserialization of untrusted data, allowing attackers to execute malicious code over the network without any authentication.

What to do

If exploited, this vulnerability could allow attackers to run arbitrary code, potentially compromising sensitive data or taking complete control of the SharePoint server. That’s a full-scale invasion of your digital space, and it could lead to devastating data breaches or system crashes. 🚨 Ensure you implement the provided mitigations from Microsoft immediately while waiting for the comprehensive update. It's crucial to review your SharePoint Server configurations and limit network access to minimize exposure. Stay vigilant and monitor your systems closely! You’ve got this! With prompt action and the right precautions, you can keep your systems safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99999 · 100.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-07-20T05:15Z
KEV added
2025-07-20 · due 2025-07-21
Affected products (3)
ProductVersionsFixed in
microsoft/sharepoint_server< 16.0.18526.2050816.0.18526.20508
microsoft/sharepoint_serverall versions—
microsoft/sharepoint_serverall versions—
References (13)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 · [email protected]https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/ · af854a3a-2127-422b-91ae-364da2661108https://github.com/kaizensecurity/CVE-2025-53770 · af854a3a-2127-422b-91ae-364da2661108https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ · af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=44629710 · af854a3a-2127-422b-91ae-364da2661108https://research.eye.security/sharepoint-under-siege/ · af854a3a-2127-422b-91ae-364da2661108https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally · af854a3a-2127-422b-91ae-364da2661108https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/ · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 · af854a3a-2127-422b-91ae-364da2661108https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw · af854a3a-2127-422b-91ae-364da2661108https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/ · af854a3a-2127-422b-91ae-364da2661108https://x.com/Shadowserver/status/1946900837306868163 · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 JUL 01:06Z
    Microsoft SharePoint Server Remote Code Execution Vulnerability
    cvelistv5
  • 20 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 21
    kev