Actively Exploited SharePoint Zero-Days Enable Authentication Bypass and Remote Code Execution
Summary
CVE-2025-53770 and CVE-2025-53771 affect on-premises SharePoint servers and are actively exploited via the ToolShell chain. Microsoft issued patches; the article outlines affected versions, exploitation, and mitigation steps.
Key points
- CVE-2025-53771 enables authentication bypass through a forged Referer header; CVE-2025-53770 enables remote code execution through unsafe deserialization.
- The flaws affect on-premises SharePoint Server, including self-managed cloud instances, but not SharePoint Online.
- Affected versions include SharePoint Subscription Edition, 2019, and 2016; unsupported 2010 and 2013 versions are also noted as affected.
- Microsoft released emergency patches for Subscription Edition and SharePoint Server 2019; the article advises monitoring for a 2016 patch.
- The described attack chain can install an ASPX web shell, extract machine keys, and use forged ViewState payloads to execute code.
- Recommended actions include applying updates, enabling AMSI, rotating machine keys, isolating exposed servers, and investigating for compromise.
- Wiz reports that 9% of cloud environments it assessed had resources running vulnerable self-managed SharePoint versions.
Article Details
- Vulnerability Types
- Remote code execution via unsafe deserialization of untrusted data
- Authentication bypass via forged Referer header spoofing
- Severity
- CVE-2025-53770: CVSS 9.8 (critical); CVE-2025-53771: CVSS 6.3
- Affected Versions
- SharePoint Server Subscription Edition earlier than KB5002768
- SharePoint Server 2019 earlier than 16.0.10417.20027 / KB5002754
- SharePoint Server 2016
- SharePoint Server 2010
- SharePoint Server 2013
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- If patches or AMSI cannot be applied, disconnect internet-facing SharePoint servers.
- Enable AMSI in Full Mode.
- Rotate ASP.NET Machine Keys after patching or enabling AMSI.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]186[.]30[.]186 | IP address listed among observed indicators of compromise for the SharePoint exploitation. |
| IPV4 | 104[.]238[.]159[.]149 | IP address listed among observed indicators of compromise for the SharePoint exploitation. |
| IPV4 | 107[.]191[.]58[.]76 | IP address listed among observed indicators of compromise for the SharePoint exploitation. |
| IPV4 | 96[.]9[.]125[.]147 | IP address listed among observed indicators of compromise for the SharePoint exploitation. |
| SHA256 | 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514 | SHA256 hash of the spinstall0.aspx web shell identified in the observed exploitation. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterAttackers used signed malicious __VIEWSTATE payloads to execute embedded commands on the SharePoint server.T1059.001 · PowerShellThe observed w3wp.exe process spawned encoded PowerShell.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in internet-accessible on-premises SharePoint servers for initial access.T1505.003 · Web ShellAttackers dropped the spinstall0.aspx ASPX web shell into a SharePoint layouts directory for persistent remote access.T1552.004 · Private KeysThe web shell extracted the server's ValidationKey and DecryptionKey from its machineKey configuration.
CVE
CVE-2025-49704CVE-2025-53770 is a bypass of the fix for CVE-2025-49704 (original deserialization/RCE).CVE-2025-49706CVE-2025-53771 is a bypass of the fix for CVE-2025-49706 (original spoofing bug).CVE-2025-53770Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771.CVE-2025-53771Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771.
Vendors
Products
ASP.NETThese keys are critical for forging valid, signed ASP.NET ViewState payloads that SharePoint will trust.Microsoft 365 SharePoint OnlineThese flaws affect on-premises SharePoint servers only and are not applicable to Microsoft 365 SharePoint Online.Microsoft SharePoint ServerThe vulnerabilities apply exclusively to on-premises deployments of Microsoft SharePoint Server. This includes servers running on physical hosts as well as self-managed SharePoint instances running in the cloud.
Tools
AMSIDisconnect internet-facing SharePoint servers if patches or AMSI can’t be appliediisreset.exeRestart IIS with iisreset.exePowerShellProcess name: w3wp.exe spawning encoded PowerShellToolShellCVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.ysoserialRemote Code Execution: Using tools like ysoserial, the attacker crafts malicious __VIEWSTATE payloads signed with the stolen keys.