CVE-2025-53770

CVE-2025-53770: Critical SharePoint Server Deserialization RCE Under Active Exploitation

AI-generated analysis based on the vulnerability data on this page.

Summary

A critical deserialization-of-untrusted-data vulnerability in on-premises Microsoft SharePoint Server enables unauthenticated remote code execution over the network. Microsoft has confirmed that exploits exist in the wild and that a comprehensive security update is still under preparation.

Background

In July 2025, security researchers and Microsoft identified active exploitation of a zero-day vulnerability in on-premises SharePoint Server deployments. The flaw resides in how SharePoint handles deserialization of attacker-controlled data, a historically high-impact vulnerability class in .NET-based enterprise applications. Because SharePoint is commonly exposed to internal networks and often to the internet for hybrid collaboration, the attack surface is significant.

Root Cause

The vulnerability is classified under CWE-502: Deserialization of Untrusted Data. SharePoint Server improperly deserializes data from untrusted sources without adequate validation or sandboxing. In .NET environments, unsafe deserialization can allow attackers to instantiate arbitrary object types, chain gadget methods, and ultimately execute operating-system commands with the privileges of the SharePoint application pool — typically NT AUTHORITY\SYSTEM or an equivalent high-privilege account on Windows Server.

Impact

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a base score of 9.8 (CRITICAL):

• Attack Vector: Network — exploitable remotely without local access.
• Attack Complexity: Low — no special conditions or race conditions required.
• Privileges Required: None — unauthenticated exploitation is possible.
• User Interaction: None — fully automated attacks are viable.
• Scope: Unchanged — the vulnerable component is the SharePoint server itself.
• Confidentiality, Integrity, Availability: All rated HIGH.

The near-certain probability of exploitation is underscored by an EPSS of 0.99982 (99.98th percentile), and CISA added the CVE to the Known Exploited Vulnerabilities catalog on the same day it was published.

Exploitation Walkthrough

Ethics caveat: The following description is provided for defensive awareness only. No weaponized exploit code is included. Security professionals should use this knowledge to improve detection and hardening, not to attack systems without authorization.

The attack likely proceeds as follows:

1. Reconnaissance: The attacker identifies an on-premises SharePoint Server instance reachable over TCP/443 (or the configured alternate port).
2. Payload crafting: The attacker constructs a serialized .NET object payload designed to trigger a gadget chain during deserialization. The specific entry point is a SharePoint endpoint or service that accepts serialized objects without cryptographic signatures or type whitelisting.
3. Delivery: The payload is transmitted over HTTP(S) to the vulnerable endpoint. Because no authentication or user interaction is required, the request can be sent directly by the attacker.
4. Execution: SharePoint deserializes the payload, the gadget chain executes within the application worker process, and the attacker gains remote code execution with the privileges of the SharePoint service account.

Defenders should monitor for anomalous serialized object traffic, unexpected process spawning from the SharePoint worker process (w3wp.exe), and outbound network connections originating from the SharePoint server.

Affected and Patched Versions

Affected products (per CPE data):

• Microsoft SharePoint Server — Subscription Edition
• Microsoft SharePoint Server 2016 (Enterprise)
• Microsoft SharePoint Server 2019

Patched versions: As of the last-modified date (2026-06-17), Microsoft has not released a comprehensive security patch. Microsoft has stated that a mitigation is available and a full update is under preparation. Administrators should consult the official Microsoft Security Response Center guidance for the latest patch status.

Remediation

1. Apply Microsoft's interim mitigation immediately. Follow the guidance published in the MSRC blog post and CISA alert referenced below.
2. Network segmentation: Restrict SharePoint management and farm-tier traffic to dedicated VLANs. Do not expose on-premises SharePoint directly to the internet unless strictly required.
3. Web Application Firewall (WAF): Deploy a WAF with rules tuned to detect anomalous serialized object payloads and block requests matching known exploit signatures.
4. Least privilege: Ensure the SharePoint application pool identity runs with the minimum privileges necessary. Avoid NT AUTHORITY\SYSTEM or domain-administrator accounts for application pools.
5. Monitor for exploitation: Enable process-creation and PowerShell logging on SharePoint servers. Alert on unexpected child processes spawned by w3wp.exe.
6. Patch immediately when Microsoft releases the comprehensive update. Given the active exploitation and 9.8 CVSS score, this should be treated as a P0 change-window item.

Detection

• Network: Inspect HTTP(S) traffic to SharePoint for unusually large POST bodies or Content-Type headers associated with binary serialization formats (e.g., application/octet-stream carrying .NET serialized data).
• Endpoint: Monitor Windows Event ID 4688 (process creation) for suspicious child processes of w3wp.exe, such as cmd.exe, powershell.exe, or mshta.exe.
• EDR/XDR: Look for anomalous in-memory activity in the SharePoint worker process, including reflective DLL injection or suspicious .NET assembly loads.
• Threat-intelligence feeds: Correlate SharePoint server IPs against known exploit-server indicators shared by CISA and Shadowserver.

Assessment

With an EPSS of 0.99982 and confirmed KEV status, CVE-2025-53770 is not a theoretical risk — it is a near-certain exposure for any reachable, unpatched on-premises SharePoint Server. The absence of a permanent patch at the time of writing makes interim mitigation and detection the only viable defensive layers.

Key lessons:

1. Deserialization is a critical attack surface in enterprise .NET applications. Frameworks and products that accept serialized objects from untrusted sources must implement strict type whitelisting or move to safer data formats such as JSON with schema validation.
2. Zero-day response velocity matters. The gap between disclosure and patch availability is a window of guaranteed exploitation for high-value enterprise software. Organizations should have pre-approved emergency change processes and network-isolation playbooks ready for such scenarios.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
• https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/
• https://github.com/kaizensecurity/CVE-2025-53770
• https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
• https://news.ycombinator.com/item?id=44629710
• https://research.eye.security/sharepoint-under-siege/
• https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally
• https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/
• https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
• https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw
• https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/
• https://x.com/Shadowserver/status/1946900837306868163
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770