Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2025-53770 · Published 20/07/2025 · updated 04/08/2026

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 20/07/2025. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

Package	Affected versions	Patched versions
sharepoint server microsoft	`= 2016= 2019< 16.0.18526.20508`	`16.0.18526.20508`

Description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 · Vendor Advisory
arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe · Exploit
kaizensecurity/CVE-2025-53770 · Exploit
msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770 · Mitigation
news.ycombinator.com/item · Issue Tracking
research.eye.security/sharepoint-under-siege · Exploit
therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally · Press/Media Coverage
bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available · Press/Media Coverage
cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 · Mailing List
darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw · Press/Media Coverage
forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available · Press/Media Coverage
x.com/Shadowserver/status/1946900837306868163 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2025-53770

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free