---
id: 7293
title: "[CVE-2025-49704] ToolShell - A Critical SharePoint Vulnerability Chain under Active Exploitation"
cve: CVE-2025-49704
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/toolshell-a-critical-sharepoint-vulnerability-chain-under-active-exploitation/"
published_at: "2025-07-24T10:37:11Z"
tags: ["rce", "authentication-bypass", "threat-hunting", "sharepoint", "ioc", "cve-2025-49704", "toolshell"]
phying_url: "https://phying.com/item/7293"
lang: en
---

# [CVE-2025-49704] ToolShell - A Critical SharePoint Vulnerability Chain under Active Exploitation

## Summary

Viettel dissects the ToolShell SharePoint chain—CVE-2025-49704 deserialization RCE and CVE-2025-49706 auth bypass—actively exploited, with patch bypasses CVE-2025-53770/53771 and hunting guidance.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **CVE:** CVE-2025-49704
- **Published:** 2025-07-24T10:37:11Z
- **Original:** https://blog.viettelcybersecurity.com/toolshell-a-critical-sharepoint-vulnerability-chain-under-active-exploitation/
- **Phying News:** https://phying.com/item/7293