KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-53770
9.8
3-Day Required
PoC Available
KEV
Automatable
Active Exploitation
Details
VulnerabilityMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability
VendorMicrosoft
ProductSharePoint
Date added2025-07-20
Due date2025-07-21
CISA catalogView on CISA KEV catalog
Required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
CWECWE-502
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
NVD: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-06-18 08:00 UTC
Searches20
Component defaultyes
QC notes
warn component_extraction: Component 'ToolPane.aspx (ToolShell endpoint) — /_layouts/15/ToolPane.aspx SharePoint Layouts component for web part editing; also exploits the Scorecard:ExcelDataSet PerformancePoint web control with CompressedDataTable property for ViewState deserialization' matches or contains product name 'SharePoint' — no specific component identified
Hunting hypothesis agent
Hunt for HTTP POST requests to ToolPane.aspx leveraging stolen MachineKeys for ViewState deserialization achieving unauthenticated RCE on on-premises Microsoft SharePoint servers.
Research details
ComponentToolPane.aspx (ToolShell endpoint) — /_layouts/15/ToolPane.aspx SharePoint Layouts component for web part editing; also exploits the Scorecard:ExcelDataSet PerformancePoint web control with CompressedDataTable property for ViewState deserialization
PreconditionsNetwork reachability to the /_layouts/15/ToolPane.aspx endpoint on a supported on-premises SharePoint Server (2016, 2019, Subscription Edition); no authentication required (unauthenticated); target must be internet-facing or network-accessible; patch bypass of CVE-2025-49704 (ToolShell chain originally demonstrated at Pwn2Own Berlin May 2025 by Viettel Cyber Security); ASP.NET ViewState validation keys (MachineKey: ValidationKey + DecryptionKey) not rotated after prior patch, enabling attacker to forge signed ViewState payloads. The exploit chain is: (1) HTTP POST to ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx with crafted Referer header /_layouts/SignOut.aspx to bypass authentication; (2) Upload of a malicious ASPX web shell (spinstall0.aspx, info3.aspx, or variants) to the TEMPLATE\LAYOUTS directory to extract MachineKey values from web.config; (3) Use stolen MachineKeys with ysoserial.net to forge signed ViewState payloads via the Scorecard:ExcelDataSet deserialization gadget (CompressedDataTable property) for unauthenticated RCE; (4) Post-exploitation deployment of IIS .NET modules (bjcloiyq.dll/osvmhdfl.dll) for persistent MachineKey exfiltration via HTTP response headers, and SharpyShell webshell for ongoing access. CISA MAR-251132 provides YARA rules, SIGMA rules, and confirmed IOCs including IPs 107.191.58.76, 104.238.159.149, 96.9.125.147, and 91.236.230.76. agent
DeliveryHTTP POST request to /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx with a crafted Referer header value of /_layouts/SignOut.aspx to bypass authentication. The POST body contains a malicious ASPX file or a base64-encoded ViewState payload exploiting deserialization of the Scorecard:ExcelDataSet control (CompressedDataTable property). Successful exploitation uploads a web shell (typically spinstall0.aspx, info3.aspx, or variants) to the TEMPLATE\LAYOUTS directory, which then extracts cryptographic machine keys from the SharePoint server's web.config. Post-exploitation, attackers deploy IIS .NET modules (bjcloiyq.dll/osvmhdfl.dll) to exfiltrate MachineKey values in HTTP response headers, and SharpyShell webshells for persistent access.
Public PoCyes
PoC URLs
https://github.com/MuhammadWaseem29/CVE-2025-53770
https://github.com/saladin0x1/CVE-2025-53770 Third-party repos; verify before use.
https://github.com/saladin0x1/CVE-2025-53770 Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8) | Exploit chain requires: (1) HTTP POST to ToolPane.aspx with crafted Referer header /_layouts/SignOut.aspx to bypass auth, (2) Upload of malicious ASPX web shell (e.g., spinstall0.aspx) to extract MachineKey (ValidationKey + DecryptionKey), (3) Use stolen keys with ysoserial.net to forge signed ViewState payloads via Scorecard:ExcelDataSet deserialization for unauthenticated RCE. CISA MAR-251132 (August 2025) documented SharpyShell webshell variants (spinstall0.aspx, info3.aspx, spinstallp.aspx, spinstallb.aspx) and two .NET DLL payloads (bjcloiyq.dll, osvmhdfl.dll) designed to extract MachineKey settings and add them to HTTP response headers. The CISA MAR also published SIGMA detection rules and YARA signatures for these payloads.
SummaryCVE-2025-53770 is a CRITICAL (CVSS 9.8) unauthenticated RCE vulnerability in on-premises Microsoft SharePoint Server, first disclosed July 19, 2025 and added to CISA KEV on July 20, 2025. It is a patch bypass for CVE-2025-49704 (ToolShell chain, originally demonstrated at Pwn2Own Berlin May 2025 by Viettel Cyber Security). The vulnerability resides in the ToolPane.aspx endpoint (/layouts/15/) and enables attackers to: (1) bypass authentication via a crafted Referer header, (2) upload a web shell that extracts cryptographic MachineKeys, and (3) forge signed ViewState payloads using tools like ysoserial.net to achieve unauthenticated RCE via unsafe deserialization of the Scorecard:ExcelDataSet control (CompressedDataTable property). Multiple threat actors (including CL-CRI-1040/Storm-2603, a China-based group tracked as MITRE ATT&CK Campaign C0058) have conducted widespread exploitation starting July 17, 2025, targeting finance, education, energy, healthcare, and government sectors globally. Exploitation has led to ransomware deployment (4L4MD4R variant), IIS module persistence for ongoing MachineKey theft, and data theft. CISA released MAR-251132 on August 6, 2025 with YARA/SIGMA rules and IOCs. Splunk released detection analytics for ToolPane endpoint exploitation and post-exploitation webshell activity. Microsoft released patches for SharePoint Subscription Edition and 2019 on July 19, 2025. Key mitigations: apply latest patches, rotate MachineKeys, disconnect internet-facing SharePoint until remediated.
Tia coverage
First reported2026-10-01
First exploit report2026-10-02
Exploit report → KEV439 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.