Tool Shell Zero-Day: CVE-2025-53770 Share Point RCE, Patch Now | Qualys

Summary: On July 19, 2025, Microsoft issued an emergency out-of-band update for two SharePoint Server zero-days, CVE-2025-53770 and CVE-2025-53771, both under active exploitation. CVE-2025-53770 is a critical 9.8 deserialization flaw allowing unauthenticated remote code execution, while CVE-2025-53771 is a 6.3 path-traversal spoofing flaw that plays a role in the attack chain, dubbed "ToolShell."
What's compelling: Exploitation lets an unauthenticated attacker run code on the server and steal ASP.NET machine keys, which can be used to forge authentication tokens and keep persistent access - and CISA has already added CVE-2025-53770 to its KEV list while NHS England issued High-Severity Alert CC-4683.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-53770 CVE-2025-53771
Related: Tool Shell: Details of CVEs affecting Share Point servers Cyber Risks ·
Microsoft Fix Targets Attacks on Share Point Zero-Day Cyber Risks ·
Active Exploitation of Microsoft Share Point Vulnerabilities: Threat Brief (Updated August 12) Cyber Risks ·