CVE-2025-53770
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-53770 is a critical insecure deserialization vulnerability in on-premises Microsoft SharePoint Server that enables an unauthenticated attacker to execute arbitrary code remotely over the network. With the near-maximum CVSS v3.1 base score of 9.8 (Critical), this vulnerability has been actively exploited globally as a zero-day, prompting Microsoft to issue emergency guidance while preparing a comprehensive fix. CISA has added CVE-2025-53770 to the Known Exploited Vulnerabilities catalog with an immediate remediation deadline of July 21, 2025, and has confirmed its use in ransomware campaigns. The EPSS score of 90.95% at the 99th percentile makes this one of the most exploited vulnerabilities in the entire threat landscape, demanding immediate action from all organizations running on-premises SharePoint Server.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | < 16.0.18526.20508; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770(Vendor Advisory)
- https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/(Exploit, Press/Media Coverage)
- https://github.com/kaizensecurity/CVE-2025-53770(Exploit)
- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/(Mitigation, Vendor Advisory)
- https://news.ycombinator.com/item?id=44629710(Issue Tracking)
- https://research.eye.security/sharepoint-under-siege/(Exploit, Mitigation, Third Party Advisory)
- https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally(Press/Media Coverage)
- https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/(Press/Media Coverage)
- https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770(Mailing List, Third Party Advisory, US Government Resource)
- https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw(Press/Media Coverage)
- https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/(Press/Media Coverage)
- https://x.com/Shadowserver/status/1946900837306868163(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-53770 is classified under CWE-502, which describes vulnerabilities where an application deserializes data from untrusted sources without properly verifying that the resulting data is valid and safe. In Microsoft SharePoint Server, the deserialization mechanism processes untrusted data submitted by remote attackers, which can include malicious serialized objects that execute arbitrary code when deserialized. This class of vulnerability is particularly dangerous because deserialization occurs before most application-level security checks, allowing attackers to achieve code execution without authentication.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2025-53770 has a CVSS v3.1 base score of 9.8 (Critical), representing one of the most severe vulnerability profiles possible. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication whatsoever (PR:N), and demands no user interaction (UI:N). All three CIA dimensions face maximum impact: Confidentiality (High) exposes all documents, credentials, and metadata stored in SharePoint; Integrity (High) enables the attacker to modify or destroy any data; and Availability (High) allows complete disruption of SharePoint services. The confirmed ransomware exploitation makes this vulnerability existentially threatening to organizations — threat actors are using it for mass data exfiltration followed by encryption and extortion. With an EPSS score of 90.95% at the 99th percentile, this vulnerability is more likely to be exploited than 99% of all known vulnerabilities, and the zero-day exploitation confirms that attackers had weaponized it before any patch was available.
Exploit Maturity
CVE-2025-53770 represents the highest possible exploit maturity level. It was exploited as a zero-day vulnerability globally before any patch was available, and Microsoft has explicitly acknowledged that "an exploit for CVE-2025-53770 exists in the wild." Multiple public exploit sources are available, including a GitHub PoC repository, detailed technical research from Eye Security, and coverage from Ars Technica. CISA has designated this vulnerability with a known ransomware association and issued an immediate remediation deadline. The EPSS score of 90.95% at the 99th percentile is among the highest observed for any vulnerability. Microsoft has published emergency customer guidance while developing a comprehensive patch, indicating the severity and urgency of this threat.
Remediation
-
Apply Microsoft's emergency mitigations immediately. Follow the guidance in Microsoft's customer advisory for CVE-2025-53770 and the MSRC update guide. Apply the comprehensive update when it becomes available. Update SharePoint Server to version 16.0.18526.20508 or later when released.
-
Disconnect end-of-life and vulnerable instances. Immediately disconnect public-facing SharePoint Server instances that have reached end-of-life (SharePoint Server 2013 and earlier). For SharePoint Server 2016 and 2019, isolate from the internet until mitigations are confirmed in place.
-
Implement emergency network controls. Block all external access to SharePoint Server immediately. If business continuity requires external access, route all traffic through a web application firewall with deserialization attack detection rules and restrict access to known trusted IP ranges.
-
Conduct emergency incident response. Given the zero-day exploitation and ransomware association, treat all unpatched internet-facing SharePoint instances as potentially compromised. Engage incident response teams to perform forensic analysis, check for web shells, unauthorized accounts, data exfiltration indicators, and ransomware deployment artifacts.
-
Prepare ransomware recovery capabilities. Verify that offline, immutable backups of all SharePoint data exist and are current. Test recovery procedures and ensure that backup systems are not accessible from the SharePoint server network segment. Implement or verify endpoint detection and response coverage on all SharePoint servers.
Technical Details
CVE-2025-53770 is an insecure deserialization vulnerability in on-premises Microsoft SharePoint Server with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in SharePoint's handling of serialized data, where the application deserializes objects from untrusted input without adequate validation. An unauthenticated attacker can submit specially crafted serialized payloads over the network that, when processed by SharePoint's deserialization logic, instantiate malicious objects leading to arbitrary code execution on the server. The deserialization occurs at a stage in request processing that precedes authentication checks, enabling exploitation without any credentials. The Eye Security research details how the exploitation chain works in practice, and a public proof-of-concept demonstrates the full attack. Affected versions include SharePoint Server prior to version 16.0.18526.20508, as well as SharePoint Server 2016 and 2019. Microsoft's acknowledgment that the exploit exists in the wild, combined with the publication of multiple public exploit sources, means that the barrier to exploitation is minimal for threat actors of any sophistication level.
Frequently Asked Questions
Is CVE-2025-53770 being actively exploited?
Yes. CVE-2025-53770 was exploited globally as a zero-day before any patch was available. Microsoft has confirmed that "an exploit exists in the wild." CISA has designated it with a known ransomware association. The EPSS score of 90.95% at the 99th percentile makes it one of the most exploited vulnerabilities in existence.
What products are affected by CVE-2025-53770?
Microsoft SharePoint Server prior to version 16.0.18526.20508, SharePoint Server 2016, and SharePoint Server 2019 are affected. This impacts on-premises deployments only — SharePoint Online (Microsoft 365) is not affected.
How do I fix CVE-2025-53770?
Apply Microsoft's emergency mitigations from the customer guidance advisory immediately. Install the comprehensive update (version 16.0.18526.20508 or later) when available. Disconnect end-of-life SharePoint versions and block external access to vulnerable instances. Conduct incident response for any previously exposed instances.
How severe is CVE-2025-53770?
CVE-2025-53770 is rated Critical with a CVSS v3.1 score of 9.8, with confirmed zero-day exploitation and ransomware usage. It allows unauthenticated remote code execution with no user interaction. At the 99th EPSS percentile, it is among the most dangerous vulnerabilities ever tracked by CISA.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.