Critical Vulnerabilities in Microsoft Sharepoint

Update

Microsoft has confirmed that these vulnerabilities are being actively exploited on unpatched, on-premises SharePoint servers to gain persistent access, steal credentials, and in some cases, deploy ransomware. Please refer here for the latest information from Microsoft.

Background

Microsoft has released security updates addressing zero-day vulnerabilities (CVE-2025-53770 and CVE-2025-53771) impacting on-premise Sharepoint Servers. SharePoint Online in Microsoft 365 is not affected by the vulnerabilities.

Impact

CVE-2025-53770: Deserialisation of untrusted data in on-premise Microsoft SharePoint Servers could allow a remote attacker to perform remote code execution. This vulnerability has a Common Vulnerability Scoring System (CVSSv3.1) score of 9.8 out of 10.

CVE-2025-53771: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint could allow a remote attacker to spoof a legitimate SharePoint workflow using a forged Referer header and bypass authentication.

When the aforementioned vulnerabilities are successfully exploited in sequence, they could allow an attacker to execute remote code in Microsoft SharePoint.

Known Exploitation

Microsoft is aware of active exploitation of these vulnerabilities.

Affected Products

These vulnerabilities affect on-premises installations of:

• Microsoft SharePoint Server Subscription Edition

• Microsoft SharePoint Server 2019

• Microsoft SharePoint Server 2016

SharePoint 2010 and 2013 may also be affected by these vulnerabilities.

Exploit Chain Breakdown

The attack has been observed to unfold in five key stages:

1. Initial Access: 

   • Attackers send a specially crafted HTTP request to the endpoint /layouts/15/ToolPane.aspx, with a forged Referer header set to /_layouts/SignOut.aspx. This allows them to bypass authentication controls.

   • Command execution is conducted using the w3wp.exe process that supports SharePoint for enumeration and environment discovery.

2. Execution:

   • The attackers send a crafted POST request to upload a malicious ASPX file named spinstall0.aspx to the SharePoint server. This file is designed to extract cryptographic secrets from the environment.

   • Lateral movement using PsExec and the Impacket toolkit, executing commands using Windows Management Instrumentation (WMI).

3. Persistence:

   • The attackers create scheduled tasks and manipulates Internet Information Services (IIS) components to load suspicious .NET assemblies. These actions ensure continued access even if initial vectors are remediated.

   • services.exe is abused to disable Microsoft Defender protections through direct registry modifications.

4. Credential Access:

   • The spinstall0.aspx script retrieves the server’s MachineKey configuration, including the ValidationKey. This key is critical for crafting valid __VIEWSTATE payloads used in ASP.NET.

   • The threat actor uses Mimikatz, specifically targeting the Local Security Authority Subsystem Service (LSASS) memory to extract plaintext credentials

5. Command and Control:

   • With the stolen cryptographic keys, the attackers use tools such as ysoserial to generate valid serialised __VIEWSTATE objects. These payloads are then deserialized by SharePoint, enabling unauthenticated remote code execution. The file spinstall0.aspx has been observed in the following path: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0[.]aspx.

   • Modifies Group Policy Objects (GPO) to distribute Warlock ransomware in compromised environments.

Mitigation

Administrators are strongly advised to upgrade their on-premise Sharepoint Server with the latest emergency update provided by Microsoft. Use or upgrade to supported versions of on-premises Microsoft SharePoint Server: SharePoint Server 2016, 2019, and SharePoint Subscription Edition.

In addition to applying the security updates, the following steps are recommended to detect/prevent persistence and block post-exploitation activity:

• Ensure the Antimalware Scan Interface (AMSI) is turned on and configured correctly.

  • Configure Antimalware Scan Interface (AMSI) integration in SharePoint, enable Full Mode for optimal protection, and deploy Defender Antivirus on all SharePoint servers which will stop unauthenticated attackers from exploiting this vulnerability.

  • If you cannot enable AMSI, we recommend you consider disconnecting your server from the Internet until you have applied the most current security update linked above. If the server cannot be disconnected from the internet, consider using a VPN or proxy requiring authentication or an authentication gateway to limit unauthenticated traffic

• Deploy Microsoft Defender for Endpoint, Microsoft Defender Antivirus or equivalent anti-virus solutions to scan for malware (e.g., web shells) on all Sharepoint servers.

• Rotate SharePoint Server ASP.NET machine keys and restart Internet Information ServiceS (IIS) on all SharePoint servers. 

  • Follow the PowerShell guidance here.

  • If you cannot enable AMSI, you will need to rotate your keys and restart IIS after you install the new security update.

• Use Hunting Queries, Microsoft Defender Vulnerability Management or Microsoft Sentinel to inspect events in your network and locate potential related indicators. Follow the guidance here.

• For guidance on measures to protect against post-exploitation activity, please refer here.

Known Indicators Of Compromise (IOC)

Reporting Compromise

If you assess that your Sharepoint server has been compromised, please report the incident to SingCERT at https://www.csa.gov.sg/resources/singcert/cyber-aid.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770

https://nvd.nist.gov/vuln/detail/CVE-2025-53770

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771

https://nvd.nist.gov/vuln/detail/CVE-2025-53771

https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/

https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities

https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/

https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ https://www.cyber.gc.ca/en/alerts-advisories/al25-009-vulnerability-impacting-microsoft-sharepoint-server-cve-2025-53770

https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-microsoft-sharepoint-servers-cve-2025-53770/

https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/

https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html