--- title: Widespread Exploitation against Microsoft SharePoint On-Premises description: Critical Remote Code Execution Vulnerability in Veeam Backup & Replication (CVE-2025-23120) image: https://www.coolspirit.co.uk/hubfs/Arctic%20Wolf%20PR.jpg --- # Bulletin: Microsoft SharePoint On-Premises Exploitation ![](https://www.coolspirit.co.uk/hubfs/website/images/curves/hero/pngs/hero-curve-white.png) ## Widespread Exploitation against Microsoft SharePoint On-Premises Written on: ** Jul 23, 2025 9:17:56 AM ** Written by: ** Alex Raben ** Topic [Data Security, COOLSPIRiT, Cyber Security, Arctic Wolf] Share this post: Widespread Exploitation of ToolShell RCE Vulnerability Observed in Microsoft SharePoint On-Premises (CVE-2025-53770) This July, a widespread exploitation began against a critical zero-day vulnerability affecting on-premises versions of Microsoft SharePoint. As the situation is ongoing, we strongly recommend that any organisation running on-premises SharePoint review this security information, upgrade to the latest fixed versions, and apply all recommended mitigations.  **Summary** On July 19, 2025, Microsoft [disclosed](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GI7Al3_CNSe1RbAJ6iCHKTJ_OfmYNtt1UYZtDCKy-k1q5ceg_g2Rwd_yML6DcwSmeno=) active exploitation of a zero-day vulnerability (CVE-2025-53770) affecting on-premises SharePoint Server instances. Originally, no patch was available for this vulnerability, but fixes were released late on the evening of July 20. CVE-2025-53770 is caused by the deserialization of untrusted data, allowing unauthenticated threat actors to execute code remotely over the network. It is a variant of [CVE-2025-49706](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GDuX1zzjJ2esiizvVzY6Z_VBNw3l7y9odXZHARfHl92z1DOB7Y6X-vUaxUbYSDn1FoE=), a medium-severity flaw addressed in Microsoft’s July Patch Tuesday update. SharePoint Online in Microsoft 365 is not affected by this vulnerability.  Independent reporting has identified exploitation affecting a number of organisations across government departments, multinational corporations, and organisations in the banking sector. Arctic Wolf observed exploitation attempts involving CVE-2025-53770 starting on July 18, 2025. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities Catalog on July 20, 2025. Independent reporting has identified exploitation affecting [a number of organisations](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GBuSYlQfDKJzoO7M6LEepocIgBhoWZQkJg4NzlfBr_UB4rMykqbOPyCsUZgbT6owjXk=) across government agencies, multinational corporations, and organisations in the banking sector. Arctic Wolf observed exploitation attempts involving CVE-2025-53770 starting on July 18, 2025. CISA [added](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4F0cUYPp7-IuB8oIr2024r-pgRAs6qun0jht3ogG5uu9oZpd5PcOEzlSTgkS1skSMOrw=) CVE-2025-53770 to its Known Exploited Vulnerabilities Catalog on July 20, 2025  In Microsoft’s original guidance, while no patch was available at the time of disclosure, they recommended configuring the [Antimalware Scan Interface (AMSI)](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GCVvb4vzKJX9OVpe5sz5IKfEos9-x2AOOrJA6EC9bTwLC21cDa9HCyYl1se6rjrTAH8=) integration in SharePoint and deploying [Microsoft Defender Antivirus (Defender AV)](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GFY7Zhpf_MoUNApL34-54hMFrSPFkqo_iYcbHBWB4ol-nUEl69VsylmjKA9kcuW4O0s=) across all SharePoint servers to block unauthenticated threat actors from exploiting CVE-2025-53770.  **Exploitation Details** The first public reporting on this activity was published by [Eye Security](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GNTCi7-sN0wKxG7RdC4RWslPNClDhudOc1jDAcIvnisW17ws1IgmisflDeX4M9jIMEc=), which, on the evening of July 18, began investigating what they initially believed to be exploitation of CVE-2025-49704 and CVE-2025-49706. These vulnerabilities were originally discovered during the Pwn2Own 2025 competition in May and are referred to collectively as “ToolShell.” Further investigation revealed the observed behavior was actually tied to a previously unknown zero-day vulnerability, later assigned CVE-2025-53770 by Microsoft. Shortly after, [Palo Alto Networks' Unit 42](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4F158HGSc3_ak6xVA55hDya-KZae1iNvq-3xjA9KjdukyFliV9y8WdJlNo3dNNs2WATw=) reported similar activity involving these vulnerabilities, with similar post-exploitation activities to the original reporting by Eye Security. In Eye Security’s research, threat actors targeted internet-exposed, on-premises SharePoint servers by sending crafted POST requests to the /_layouts/15/ToolPane.aspx endpoint, using a spoofed Referer header set to /layouts/SignOut.aspx to bypass authentication. Once access was obtained, they deployed a malicious ASPX implant ( spinstall0.aspx) to extract cryptographic secrets—specifically the MachineKey and ValidationKey used to protect ASP.NET’s __VIEWSTATE. With these keys, the threat actors used the Ysoserial tool to generate forged, signed __VIEWSTATE payloads, enabling remote code execution and persistent access without needing valid credentials. - Specifically, use of the /layouts/SignOut.aspx Referer seems to be the key that made the existing bug in CVE-2025-49706 exploitable without authentication, effectively making it a **new vulnerability (CVE-2025-53770)**. This timing coincided with a security researcher posting on [X](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GECjOPKknoY2yerRoTse6mUbt-bzL8OPS3H3g172u6kKjZ_sxY09d8kVvdTzuUH5Evw=) in the early morning of July 18, demonstrating that using /layouts/SignOut.aspx as the Referer header could bypass authentication. --- **Recommendation** Upgrade to Latest Fixed Versions Arctic Wolf **strongly recommends** that customers immediately upgrade to the latest fixed versions of SharePoint.  **Affected Version  **Microsoft SharePoint Server Subscription Edition** ** **Security Update Link **[Download Security Update for Microsoft SharePoint Server Subscription Edition (KB5002768) from Official Microsoft Download Center](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4F4Jo7JLfhQvRCxL2ppYhqsJOobvLUoawwb9cjMA2qSnodSV724BsGJ-0MKZoNJZM6Yc=) **Affected Version  **Microsoft SharePoint Server 2019 **Security Update Link **[Download Security Update for Microsoft SharePoint Server Subscription Edition (KB5002754) from Official Microsoft Download Center](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GM07FBygi4qNAYs-dPduyHBbh-r9ttgN43hJTz2akLUbzIMjOl2Fi1EXNYJNb5Vi5L0=)  ** ** **Affected Version ** Microsoft SharePoint Server 2016  **Security Update Link  ** Not yet available. Microsoft is currently developing security updates for all supported versions of SharePoint, and recommends monitoring their [blog post](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GI7Al3_CNSe1RbAJ6iCHKTJ_OfmYNtt1UYZtDCKy-k1q5ceg_g2Rwd_yML6DcwSmeno=) for the latest updates.  Note: SharePoint Online in Microsoft 365 is not impacted by CVE-2025-53770.  **Enable AMSI Integration** If you are running a publicly exposed, on-premises instance of Microsoft SharePoint and have [Defender AV ](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GFY7Zhpf_MoUNApL34-54hMFrSPFkqo_iYcbHBWB4ol-nUEl69VsylmjKA9kcuW4O0s=)installed, Arctic Wolf strongly recommends enabling [AMSI](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GCVvb4vzKJX9OVpe5sz5IKfEos9-x2AOOrJA6EC9bTwLC21cDa9HCyYl1se6rjrTAH8=) integration in SharePoint and ensuring Defender AV is deployed across all SharePoint servers. According to Microsoft, this mitigation will block unauthenticated threat actors from exploiting CVE-2025-53770.  **Disconnect On-Premises SharePoint Servers from the Public Internet** For customers unable to upgrade to the fixed version of SharePoint or apply AMSI (e.g., those not using Defender AV), Microsoft recommends disconnecting the server from the internet until a security update can be applied.  **Rotate SharePoint Server ASP.NET Machine Keys** If your organisation was running a publicly exposed, on-premises instance of Microsoft SharePoint before update applied, it is likely that your SharePoint instance was compromised. By exploiting CVE-2025-53770, threat actors can obtain encryption keys, allowing them to maintain access even if a web shell is removed. As a result, simply removing malicious artifacts may not fully eliminate the threat. If a compromise is detected, isolate the impacted server and rotate the SharePoint MachineKey to revoke the threat actor’s access.  --- **Note:** Arctic Wolf recommends following change management best practices for deploying Agent and Sysmon, including testing changes in a testing environment before deploying to production.  **References** - - Microsoft Announcement: [https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GI7Al3_CNSe1RbAJ6iCHKTJ_OfmYNtt1UYZtDCKy-k1q5ceg_g2Rwd_yML6DcwSmeno=) - Eye Security Article: [https://research.eye.security/sharepoint-under-siege/](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GNTCi7-sN0wKxG7RdC4RWslPNClDhudOc1jDAcIvnisW17ws1IgmisflDeX4M9jIMEc=) - Palo Alto Networks Unit 42 Advisory: [https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-07-19-Microsoft-SharePoint-vulnerabilities-CVE-2025-49704-and-49706.txt](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4F158HGSc3_ak6xVA55hDya-KZae1iNvq-3xjA9KjdukyFliV9y8WdJlNo3dNNs2WATw=) - The Hacker News Article: [https://thehackernews.com/2025/07/microsoft-releases-urgent-patch-for.html?m=1](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GBuSYlQfDKJzoO7M6LEepocIgBhoWZQkJg4NzlfBr_UB4rMykqbOPyCsUZgbT6owjXk=) - PoC Screenshot: [https://x.com/codewhitesec/status/1944743478350557232](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GJpJu85qTt-Qt8z7k9vqjDdtCkUosVmx0hVtjEUvb339eitUt4iy-DGaMXsdy2dA2SI=) - Microsoft Advisory (CVE-2025-53770): [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GAvLeRVn9IFpyDYAMYZNb46AH1BRSaRCT5iqKzd5m8CAdg3fW5JWeBQ-TivJRnbXKLM=) - Microsoft Advisory (CVE-2025-49706): [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GDuX1zzjJ2esiizvVzY6Z_VBNw3l7y9odXZHARfHl92z1DOB7Y6X-vUaxUbYSDn1FoE=) - Microsoft Advisory (CVE-2025-49704): [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GIFDpte-tiZoAjjdmYnK03OPUpazbqkfTntKPeeSmeY-8e8AUQQ8MiufgjrvtzwfVAE=) - CISA Adds CVE-2025-53770 to Known Exploited Vulnerabilities Catalog: [https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GFe9ekQIiZkxT2MYsfZb52GBHpBZyFkR1JHJzb3aYh_088u3syK6TlRC_y_QcHsCWJg=)  --- Article Information Source: Artic Wolf If you need further advice or help contact us today: [hello@coolspirit.co.uk](mailto:hello@coolspirit.co.uk) ![](https://www.coolspirit.co.uk/hubfs/website/images/curves/top/top-curve-dark-blue.svg) ## Discover our latest insights #### Enhance your knowledge by browsing our extensive library of case studies, brief sheets, data sheets, ebooks and white papers. If you have any immediate queries or requests, why not reach out to our team? [Explore now ](https://www.coolspirit.co.uk/insights) ###### Solutions [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) [Partners](https://www.coolspirit.co.uk/partners) [Hybrid Infrastructure](https://www.coolspirit.co.uk/solutions/hybrid-infrastructure) [Data Management](https://www.coolspirit.co.uk/solutions/data-management) [Networking](https://www.coolspirit.co.uk/solutions/networking) [Cloud](https://www.coolspirit.co.uk/solutions/cloud) [Cyber Security](https://www.coolspirit.co.uk/solutions/cyber-security) [DevOps](https://www.coolspirit.co.uk/solutions/devops) [GUARDiAN](https://www.coolspirit.co.uk/solutions/guardian) ###### Insights [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) [Blog](https://www.coolspirit.co.uk/blogs) [Case Studies](https://www.coolspirit.co.uk/case-studies) [Ebooks](https://www.coolspirit.co.uk/ebooks) [Data Sheets](https://www.coolspirit.co.uk/data-sheets) [Brief Sheets](https://www.coolspirit.co.uk/brief-sheets) [White Papers](https://www.coolspirit.co.uk/white-papers) ###### About Us [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) [Our Process](https://www.coolspirit.co.uk/about-us/our-process) [Accreditations](https://www.coolspirit.co.uk/accreditations) [Sustainability](https://www.coolspirit.co.uk/sustainability) [Social Responsibility](https://www.coolspirit.co.uk/social-responsibility) [International Shipping](https://www.coolspirit.co.uk/about/delivery-shipping) [Financing](https://www.coolspirit.co.uk/about/financing-plans) [G-Cloud 14 Framework](https://www.coolspirit.co.uk/g-cloud-14-framework) [News](https://www.coolspirit.co.uk/news) [Events](https://www.coolspirit.co.uk/events) [Contact](https://www.coolspirit.co.uk/contact-us) ###### Support [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) [GUARDiAN Support](https://www.coolspirit.co.uk/support/guardian-support) [Infrastructure Support](https://www.coolspirit.co.uk/support/infrastructure-support) ###### Get in Touch [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) T: 01246 454 222 E: [hello@coolspirit.co.uk](mailto:hello@coolspirit.co.uk) Follow us:  [Receive our newsletter ](https://www.coolspirit.co.uk/contact-us?hsLang=en) ![ISO Certifications Condensed 2025](https://www.coolspirit.co.uk/hs-fs/hubfs/ISO%20Certifications%20Condensed%202025.png?width=588&height=58&name=ISO%20Certifications%20Condensed%202025.png) COOLSPIRiT BSI Cert. Nos: FS 550303, IS 733967, EMS 753310, ITMS 764053 Registered in England No: 3600170 All rights reserved. | Copyright © COOLSPIRiT Ltd 2024 | [Cookie Policy](https://www.coolspirit.co.uk/cookie-policy?hsLang=en) | [Privacy Policy](https://www.coolspirit.co.uk/privacy-policy?hsLang=en) | [Modern Slavery Statement](https://www.coolspirit.co.uk/modern-slavery-statement)