Vulnerability (CVE)
Cisco Talos reports ongoing exploitation of CVE-2025-53770 and CVE-2025-53771, path traversal vulnerabilities affecting on-premises SharePoint Server Subscription Edition, 2016, and 2019, with Microsoft releasing update KB5002760 for SharePoint Enterprise...
Cisco Talos Incident Response reports that threat actors used public-facing application exploitation for initial access in over 60 percent of engagements this quarter, up from less than 10 percent last quarter, largely driven by ToolShell attacks on...
On Sunday, July 20, Microsoft issued an emergency update for CVE-2025-53770, an on-premises SharePoint Server flaw being actively exploited and only partially addressed by the July 8, 2025 patch; CISA called it a variant of CVE-2025-49706. Eye Security...
Unit 42 documented active exploitation of the ToolShell SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) from July 17, 2025, 08:40 UTC through July 22, 2025, by activity tracked as CL-CRI-1040, which tested...
Unit 42 reports high-confidence overlap between Microsoft's Storm-2603, a suspected China-based actor exploiting SharePoint via the ToolShell chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771), and its own tracked cluster CL-CRI-1040,...
On July 19, 2025, Microsoft issued an emergency out-of-band update for two SharePoint Server zero-days, CVE-2025-53770 and CVE-2025-53771, both under active exploitation. CVE-2025-53770 is a critical 9.8 deserialization flaw allowing unauthenticated remote...