PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-49704] ToolShell - A Critical SharePoint Vulnerability Chain under Active Exploitation

blog.viettelcybersecurity.com | vulnerability | CVE-2025-49704 | #rce | #authentication-bypass | #threat-hunting | #sharepoint | #ioc | #cve-2025-49704 | #toolshell
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Viettel dissects the ToolShell SharePoint chain—CVE-2025-49704 deserialization RCE and CVE-2025-49706 auth bypass—actively exploited, with patch bypasses CVE-2025-53770/53771 and hunting guidance.
CVE
CVE-2025-49704
Published
Collected

Related coverage

research · blog.viettelcybersecurity.com
ToolShell - Chuỗi lỗ hổng SharePoint nghiêm trọng đang bị khai thác trong thực tế
Viettel Threat Intelligence analyzes the actively exploited ToolShell chain of four SharePoint CVEs, with detection guidance for unpatched servers and post-exploitation tracing advice.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login
CVE-2026-55040: SharePoint Server Subscription Edition's token handler skips JWT signature validation, letting attackers forge Bearer tokens and log in as arbitrary accounts, including site admins.
vulnerability · blog.viettelcybersecurity.com
SharePoint ToolShell – One Request PreAuth RCE Chain
The Pwn2Own Berlin 2025 ToolShell chain combines a ToolPane authentication bypass (CVE-2025-49706) and DataSetSurrogateSelector deserialization (CVE-2025-49704) for one-request pre-auth RCE.
tool · github.com
CVE-2026-55040 PoC: Microsoft SharePoint JWT authentication bypass
The public PoC can generate a forged authentication token for a specified account, substantially lowering the barrier to validation and reproduction. Apply Microsoft security updates immediately and test only in isolated, authorized environments.
blog · wiz.io
Tracking cloud-fluent threat actors - Part one: Atomic cloud IOCs
Part one of Wiz's series on tracking cloud-fluent threat actors explains why cloud-specific IOCs—IAM metadata, control plane API calls, container image names—are essential for detection and attribution in the cloud.
vulnerability · blog.viettelcybersecurity.com
SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass
Breakdown of CVE-2026-65660, a SafeControls type-check bypass in SharePoint. It shows an in-memory webshell technique chaining into pre-auth RCE, affecting all versions through Subscription Edition.
Back