What’s Vulnerable › Vulnerabilities

CVE-2025-53770: Microsoft SharePoint Server Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-07-20
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-20 · updated 2026-08-04
• Weakness: CWE-502

Description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Summary

CVE-2025-53770 is a critical deserialization of untrusted data vulnerability in on-premises Microsoft SharePoint Server, allowing an unauthenticated attacker to execute code over the network. Exploitation is active and a public exploit exists; Microsoft confirms in-the-wild attacks, and CISA lists it as a known exploited vulnerability with a 100% EPSS probability. Affected products include SharePoint Server, fixed in version 16.0.18526.20508. Apply the update immediately; if not possible, follow Microsoft's mitigation guidance and CISA recommendations, and disconnect public-facing end-of-life versions such as SharePoint Server 2013 and earlier.

CVE-2025-53770 هو ثغرة حرجة في إلغاء تسلسل البيانات غير الموثوقة في Microsoft SharePoint Server المحلي، تسمح لمهاجم غير مصرح له بتنفيذ تعليمات برمجية عبر الشبكة. الاستغلال نشط وهناك استغلال عام معروف؛ أكدت Microsoft وقوع هجمات فعلية، وأدرجت CISA الثغرة ضمن الثغرات المستغلة المعروفة بنسبة احتمال استغلال 100% خلال 30 يومًا. تشمل المنتجات المتأثرة SharePoint Server، وتم إصلاحها في الإصدار 16.0.18526.20508. طبّق التحديث فورًا؛ وإذا تعذر ذلك، اتبع إرشادات التخفيف من Microsoft وتوصيات CISA، وافصل الإصدارات العامة التي انتهى دعمها مثل SharePoint Server 2013 والإصدارات الأقدم.

Affected products

• Microsoft SharePoint Server: before 16.0.18526.20508; 2016, 2019 — fixed in 16.0.18526.20508
• Microsoft SharePoint Server Subscription Edition: from 16.0.0 before 16.0.18526.20508 — fixed in 16.0.18526.20508
• Microsoft Sharepoint Enterprise Server 2016: from 16.0.0 before 16.0.5513.1001 — fixed in 16.0.5513.1001
• Microsoft SharePoint Server: from 16.0.0 before 16.0.10417.20037 — fixed in 16.0.10417.20037

How to fix

Upgrade to a fixed version: Microsoft SharePoint Server 16.0.18526.20508; Microsoft SharePoint Server Subscription Edition 16.0.18526.20508; Microsoft Sharepoint Enterprise Server 2016 16.0.5513.1001; Microsoft SharePoint Server 16.0.10417.20037. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
• https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/
• https://github.com/kaizensecurity/CVE-2025-53770
• https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
• https://news.ycombinator.com/item?id=44629710
• https://research.eye.security/sharepoint-under-siege/
• https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally
• https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/
• https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
• https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw
• https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/
• https://x.com/Shadowserver/status/1946900837306868163

Get alerted when CVE-2025-53770 or the next vulnerability affects your stack