Published: Tue 22 July 2025
Prepared by: Adam Skupien, Vulnerability Security Analyst
This bulletin addresses the large-scale exploitation of two recently disclosed zero-day vulnerabilities, the Critical Severity Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2025-53770) and the Medium Severity Microsoft SharePoint Server Spoofing Vulnerability (CVE-2025-53771) affecting on-premises deployments of Microsoft SharePoint servers. These vulnerabilities have been observed to be actively and widely exploited in the wild, successful exploitation could allow threat actors to remotely execute arbitrary code resulting in the exfiltration of sensitive data and persistent access.
On July 19 2025, the research team at Eye Security released a blog detailing their discovery of large-scale exploitation of two new zero-day flaws in SharePoint servers. Microsoft and affected organisations were notified.
On July 19 2025, Microsoft Security Response Center (MSRC) released advisories for both vulnerabilities in addition to the Customer guidance for SharePoint vulnerability CVE-2025-53770 blog post to disclose the information. This blog was updated over the next three days with remediation and detection guidance.
On July 20 2025, the Australian Cyber Security Centre (ACSC) issued an advisory related to CVE-2025-53770 advising organisations to review their networks for vulnerable instances and to consult the Microsoft customer advisory for mitigation advice.
The vulnerabilities affect the following Microsoft Products:
Microsoft SharePoint Server Subscription Edition (Patch is available)
Microsoft SharePoint Server 2019 (Patch is available)
Microsoft SharePoint Enterprise Server 2016 (Patch is NOT YET available)
Please note: SharePoint Online through Microsoft 365 is not impacted by this vulnerability.
Successful exploitation allows threat actors to execute code remotely and bypass identity protections such as MFA or SSO exposing all SharePoint content, system files, and configurations and allowing lateral movement across the Windows Domain and retaining persistent access.
Microsoft's Customer guidance for SharePoint vulnerability CVE-2025-53770 should be referred to for details and checked regularly for updates.
Patches should be applied as a priority as soon as available, or the affected server should be disconnected from the internet until a patch is available and can be applied.
| Product | Security Update Link |
| Microsoft SharePoint Server Subscription Edition | Download Security Update for Microsoft SharePoint Server Subscription Edition (KB5002768) from Official Microsoft Download Center |
| Microsoft SharePoint Server 2019 | Download Security Update for Microsoft SharePoint Server Subscription Edition (KB5002754) from Official Microsoft Download Center |
| Microsoft SharePoint Server 2016 | Not available yet |
Ensure the Antimalware Scan Interface (AMSI) is turned on and configured correctly, with an appropriate antivirus solution such as Defender Antivirus. If AMSI cannot be enabled, it is recommended to disconnect the server from the internet until the security update is available.
An Endpoint Detection and Response (EDR) solution such as Defender for Endpoint should be deployed to detect and block post-exploit activity.
After the security patches are applied and AMSI enabled, it is critical to rotate the SharePoint server ASP.NET machine keys and restart the Internet Information Services (IIS) in order to invalidate any tokens potentially created by a threat actor.
Customers who believe they may be affected are advised to verify their current version of SharePoint server and apply any necessary updates and/or other mitigations as outlined above.
The following Indicators of Compromise (IOC) have been observed by Eye Security and should be utilised to investigate if exploitation is suspected:
Triskele Labs customers leveraging our Vulnerability Scanning and Monitor (24×7 SIEM) or MDR services are being proactively assessed and monitored for IoC and signs of lateral movement.
