PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What is CVE-2025-53770? A Critical Microsoft SharePoint Vulnerability and How to Respond

hackerone.com | vulnerability | Critical | Actively exploited | CVE-2025-53770 | #active-exploitation | #rce | #microsoft | #threat-hunting | #sharepoint | #patching | #cve-2025-53770
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2025-53770 is a critical Microsoft SharePoint vulnerability now under active exploitation. Learn how to respond, assess exposure, and improve visibility with proactive security strategies.
CVE
CVE-2025-53770
CVSS
9.8
Published
Collected

Related coverage

research · blog.viettelcybersecurity.com
ToolShell - Chuỗi lỗ hổng SharePoint nghiêm trọng đang bị khai thác trong thực tế
Viettel Threat Intelligence analyzes the actively exploited ToolShell chain of four SharePoint CVEs, with detection guidance for unpatched servers and post-exploitation tracing advice.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login
CVE-2026-55040: SharePoint Server Subscription Edition's token handler skips JWT signature validation, letting attackers forge Bearer tokens and log in as arbitrary accounts, including site admins.
vulnerability · blog.viettelcybersecurity.com
[CVE-2025-49704] ToolShell - A Critical SharePoint Vulnerability Chain under Active Exploitation
Viettel dissects the ToolShell SharePoint chain—CVE-2025-49704 deserialization RCE and CVE-2025-49706 auth bypass—actively exploited, with patch bypasses CVE-2025-53770/53771 and hunting guidance.
vulnerability · wiz.io
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know
Wiz breaks down the exploited SharePoint ToolShell chain: CVE-2025-53770 (CVSS 9.8 RCE) and CVE-2025-53771 (spoofing) bypass July patches, hit on-prem servers only and demand emergency mitigation.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-22005 Microsoft Sharepoint RCE
Patch analysis of CVE-2022-22005, an RCE in Microsoft SharePoint (CVSS 8.8): diffing SharePoint 2016 builds pinpoints unsafe deserialization in ChartPreviewImage.loadChartImage().
vulnerability · blog.viettelcybersecurity.com
Phân tích lỗ hổng CVE-2022-22005 Microsoft Sharepoint RCE
A patch-diff analysis of CVE-2022-22005 (CVSS 8.8), a SharePoint RCE, tracing Microsoft's fix to a serialization binder restricting types during ChartPreviewImage.loadChartImage() deserialization.
Back