CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jul 20, 2025
- Updated
- Aug 4, 2026
- Reserved
- Jul 9, 2025
Description
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C | microsoft |
Weaknesses
- CWE-502 Deserialization of Untrusted Data
Affected Products
| Product | Versions |
|---|---|
Microsoft SharePoint Enterprise Server 2016Microsoft |
|
Microsoft SharePoint Server 2019Microsoft |
|
Microsoft SharePoint Server Subscription EditionMicrosoft |
|
References
- Microsoft SharePoint Server Remote Code Execution Vulnerabilityvendor-advisorypatch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770government-resource
- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
- https://research.eye.security/sharepoint-under-siege/
- https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/
- https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/
- https://x.com/Shadowserver/status/1946900837306868163
- https://github.com/kaizensecurity/CVE-2025-53770
- https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally
- https://news.ycombinator.com/item?id=44629710
- https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/
- https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.