Tool Shell: Details of CVEs affecting Share Point servers
Summary: Cisco Talos reports ongoing exploitation of CVE-2025-53770 and CVE-2025-53771, path traversal vulnerabilities affecting on-premises SharePoint Server Subscription Edition, 2016, and 2019, with Microsoft releasing update KB5002760 for SharePoint Enterprise Server 2016. The two flaws are unauthenticated remote code execution vulnerabilities related to CVE-2025-49704 and CVE-2025-49706, and CISA published technical indicators for exploitation attempts targeting unprotected SharePoint servers between July 18 and 19, 2025.
What's compelling: Attackers removed the authentication step that the earlier SharePoint flaws required, so an unpatched on-premises server can be compromised without any valid credentials, and Microsoft's guidance to rotate ASP.NET machine keys after patching indicates the signing keys themselves may already be in attacker hands.