Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SharePoint ToolShell – One Request PreAuth RCE Chain

blog.viettelcybersecurity.com | vulnerability | #rce | #deserialization | #pre-auth | #sharepoint | #pwn2own | #cve-2025-49704

Summary

The Pwn2Own Berlin 2025 ToolShell chain combines a ToolPane authentication bypass (CVE-2025-49706) and DataSetSurrogateSelector deserialization (CVE-2025-49704) for one-request pre-auth RCE.
Published
Collected

original ↗

Related coverage

  1. CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE (blog.viettelcybersecurity.com)
  2. SharePoint Unknown CVE Unveiled: RCE via WebPart Properties Deserialization (blog.viettelcybersecurity.com)
  3. Phân tích lỗ hổng CVE-2022-22005 Microsoft Sharepoint RCE (blog.viettelcybersecurity.com)
  4. CVE-2026-20963 Analysis (blog.viettelcybersecurity.com)
  5. Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject (github.com)
  6. CVE-2026-55040 PoC: Microsoft SharePoint JWT authentication bypass (github.com)

back