Top Highlights
-
Exploited Vulnerabilities: Microsoft released patches for zero-day vulnerabilities CVE-2025-53770 and CVE-2025-53771, known as ‘ToolShell’, which allow unauthenticated remote code execution on vulnerable SharePoint servers, with exploitation starting on July 18.
-
Scope of Attack: Over 9,000 instances of internet-exposed SharePoint, primarily in North America and Europe, are at risk, with attackers also exfiltrating cryptographic secrets to gain full system access.
-
Response and Mitigations: Microsoft announced security updates for SharePoint Subscription Edition and 2019, while urging organizations to enable Antimalware Scan Interface (AMSI) integration and rotate compromised cryptographic keys, as these may already be at risk.
- Previous Vulnerabilities: The new CVEs are related to earlier vulnerabilities CVE-2025-49706 and CVE-2025-49704, which were patched in July 2025, indicating that attackers may have bypassed those fixes to deploy the current exploits.
What’s the Problem?
Recently, Microsoft has initiated updates for SharePoint Server to address critical vulnerabilities, known as CVE-2025-53770 and CVE-2025-53771, exploited in attacks against on-premises servers, which became evident around July 18, as reported by cybersecurity firm Eye Security. These vulnerabilities, collectively referred to as “ToolShell,” permit unauthenticated remote code execution, allowing attackers to deploy webshells and exfiltrate sensitive cryptographic keys, thereby gaining extensive access to compromised systems. Eye Security’s internet scans revealed dozens of vulnerable SharePoint servers under attack, with a significant number of these instances located in North America and Europe, and the non-profit ShadowServer corroborated the presence of over 9,000 exposed SharePoint servers globally.
In direct response to these incidents, Microsoft has confirmed the exploitation of these vulnerabilities, quickly rolling out mitigations and security updates for SharePoint Subscription Edition and SharePoint 2019, with pending patches for SharePoint 2016. Notably, the newly assigned CVEs are intended to provide more robust protections compared to earlier versions, with the Cybersecurity and Infrastructure Security Agency (CISA) urging immediate remediation for CVE-2025-53770 among government organizations. Despite these urgent updates, organizations are advised to implement further measures, such as enabling the Antimalware Scan Interface (AMSI) in “Full Mode,” and to consider rotating cryptographic keys that may have been compromised during the attacks.
Security Implications
The recent exploitation of vulnerabilities CVE-2025-53770 and CVE-2025-53771—collectively known as ‘ToolShell’—poses a precarious threat not only to organizations reliant on on-premises SharePoint Servers but also to their interconnected ecosystems. As these vulnerabilities enable unauthenticated, remote code execution, the potential for cascading failures becomes alarmingly high; compromised systems could lead to unauthorized access to sensitive data, including cryptographic secrets. This breach not only jeopardizes the integrity and confidentiality of the affected entities but also endangers business operations, customer trust, and compliance with regulatory mandates across industries. Vulnerable organizations may inadvertently serve as launchpads for cybercriminals, amplifying risks for partners and clients who depend on shared networks and data. Consequently, the urgency of swift patch implementation cannot be overstated, as even a slight delay may embolden attackers to exploit these weaknesses, exacerbating the repercussions felt across the broader business landscape.
Possible Remediation Steps
Timely remediation is crucial in safeguarding systems against vulnerabilities that are actively being exploited, particularly in the context of the recent ‘ToolShell’ zero-day exploit targeting SharePoint servers.
Mitigation Steps
- Immediate Patch Application: Apply relevant Microsoft patches as soon as they are released to close any vulnerabilities.
- Audit Existing Configurations: Conduct a thorough review of SharePoint server configurations to ensure they adhere to security best practices.
- Access Controls: Implement strict access controls to mitigate the risk of unauthorized access.
- Network Segmentation: Isolate SharePoint servers from less secure networks to limit exposure to potential threats.
- Monitor Logs: Enhance log monitoring to identify unusual activities that could indicate exploitation.
- Security Training: Provide security awareness training to staff on recognizing phishing attempts and other social engineering tactics.
NIST CSF Guidance
The NIST Cybersecurity Framework (CSF) emphasizes continuous monitoring and rapid response to vulnerabilities. Organizations should reference NIST SP 800-53, which outlines security and privacy controls applicable to protect against such incidents.
Advance Your Cyber Knowledge
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
