---
title: Widespread Exploitation against Microsoft SharePoint On-Premises
description: Critical Remote Code Execution Vulnerability in Veeam Backup & Replication (CVE-2025-23120)
---

[Blog | COOLSPIRiT ](https://www.coolspirit.co.uk/blogs)

# [Widespread Exploitation against Microsoft SharePoint On-Premises](https://www.coolspirit.co.uk/blogs/bulletin-microsoft-sharepoint-on-premises-exploitation)

 Written by [Alex Raben](https://www.coolspirit.co.uk/blogs/author/alex-raben) | Jul 23, 2025 8:17:56 AM

Widespread Exploitation of ToolShell RCE Vulnerability Observed in Microsoft SharePoint On-Premises (CVE-2025-53770)

This July, a widespread exploitation began against a critical zero-day vulnerability affecting on-premises versions of Microsoft SharePoint. As the situation is ongoing, we strongly recommend that any organisation running on-premises SharePoint review this security information, upgrade to the latest fixed versions, and apply all recommended mitigations. 

**Summary**

On July 19, 2025, Microsoft [disclosed](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GI7Al3_CNSe1RbAJ6iCHKTJ_OfmYNtt1UYZtDCKy-k1q5ceg_g2Rwd_yML6DcwSmeno=) active exploitation of a zero-day vulnerability (CVE-2025-53770) affecting on-premises SharePoint Server instances. Originally, no patch was available for this vulnerability, but fixes were released late on the evening of July 20. CVE-2025-53770 is caused by the deserialization of untrusted data, allowing unauthenticated threat actors to execute code remotely over the network. It is a variant of [CVE-2025-49706](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GDuX1zzjJ2esiizvVzY6Z_VBNw3l7y9odXZHARfHl92z1DOB7Y6X-vUaxUbYSDn1FoE=), a medium-severity flaw addressed in Microsoft’s July Patch Tuesday update. SharePoint Online in Microsoft 365 is not affected by this vulnerability. 

Independent reporting has identified exploitation affecting a number of organisations across government departments, multinational corporations, and organisations in the banking sector. Arctic Wolf observed exploitation attempts involving CVE-2025-53770 starting on July 18, 2025. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities Catalog on July 20, 2025.

Independent reporting has identified exploitation affecting [a number of organisations](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GBuSYlQfDKJzoO7M6LEepocIgBhoWZQkJg4NzlfBr_UB4rMykqbOPyCsUZgbT6owjXk=) across government agencies, multinational corporations, and organisations in the banking sector. Arctic Wolf observed exploitation attempts involving CVE-2025-53770 starting on July 18, 2025. CISA [added](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4F0cUYPp7-IuB8oIr2024r-pgRAs6qun0jht3ogG5uu9oZpd5PcOEzlSTgkS1skSMOrw=) CVE-2025-53770 to its Known Exploited Vulnerabilities Catalog on July 20, 2025 

In Microsoft’s original guidance, while no patch was available at the time of disclosure, they recommended configuring the [Antimalware Scan Interface (AMSI)](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GCVvb4vzKJX9OVpe5sz5IKfEos9-x2AOOrJA6EC9bTwLC21cDa9HCyYl1se6rjrTAH8=) integration in SharePoint and deploying [Microsoft Defender Antivirus (Defender AV)](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GFY7Zhpf_MoUNApL34-54hMFrSPFkqo_iYcbHBWB4ol-nUEl69VsylmjKA9kcuW4O0s=) across all SharePoint servers to block unauthenticated threat actors from exploiting CVE-2025-53770. 

**Exploitation Details**

The first public reporting on this activity was published by [Eye Security](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GNTCi7-sN0wKxG7RdC4RWslPNClDhudOc1jDAcIvnisW17ws1IgmisflDeX4M9jIMEc=), which, on the evening of July 18, began investigating what they initially believed to be exploitation of CVE-2025-49704 and CVE-2025-49706. These vulnerabilities were originally discovered during the Pwn2Own 2025 competition in May and are referred to collectively as “ToolShell.” Further investigation revealed the observed behavior was actually tied to a previously unknown zero-day vulnerability, later assigned CVE-2025-53770 by Microsoft. Shortly after, [Palo Alto Networks' Unit 42](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4F158HGSc3_ak6xVA55hDya-KZae1iNvq-3xjA9KjdukyFliV9y8WdJlNo3dNNs2WATw=) reported similar activity involving these vulnerabilities, with similar post-exploitation activities to the original reporting by Eye Security.

In Eye Security’s research, threat actors targeted internet-exposed, on-premises SharePoint servers by sending crafted POST requests to the /_layouts/15/ToolPane.aspx endpoint, using a spoofed Referer header set to /layouts/SignOut.aspx to bypass authentication. Once access was obtained, they deployed a malicious ASPX implant ( spinstall0.aspx) to extract cryptographic secrets—specifically the MachineKey and ValidationKey used to protect ASP.NET’s __VIEWSTATE. With these keys, the threat actors used the Ysoserial tool to generate forged, signed __VIEWSTATE payloads, enabling remote code execution and persistent access without needing valid credentials.

- Specifically, use of the /layouts/SignOut.aspx Referer seems to be the key that made the existing bug in CVE-2025-49706 exploitable without authentication, effectively making it a **new vulnerability (CVE-2025-53770)**. This timing coincided with a security researcher posting on [X](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GECjOPKknoY2yerRoTse6mUbt-bzL8OPS3H3g172u6kKjZ_sxY09d8kVvdTzuUH5Evw=) in the early morning of July 18, demonstrating that using /layouts/SignOut.aspx as the Referer header could bypass authentication.

**Recommendation**

Upgrade to Latest Fixed Versions

Arctic Wolf **strongly recommends** that customers immediately upgrade to the latest fixed versions of SharePoint. 

**Affected Version    
**Microsoft SharePoint Server Subscription Edition**   
**

**Security Update Link  
**[Download Security Update for Microsoft SharePoint Server Subscription Edition (KB5002768) from Official Microsoft Download Center](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4F4Jo7JLfhQvRCxL2ppYhqsJOobvLUoawwb9cjMA2qSnodSV724BsGJ-0MKZoNJZM6Yc=)

**Affected Version    
**Microsoft SharePoint Server 2019

**Security Update Link   
**[Download Security Update for Microsoft SharePoint Server Subscription Edition (KB5002754) from Official Microsoft Download Center](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GM07FBygi4qNAYs-dPduyHBbh-r9ttgN43hJTz2akLUbzIMjOl2Fi1EXNYJNb5Vi5L0=)  **  
**

**Affected Version **  
Microsoft SharePoint Server 2016 

**Security Update Link  **  
Not yet available. Microsoft is currently developing security updates for all supported versions of SharePoint, and recommends monitoring their [blog post](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GI7Al3_CNSe1RbAJ6iCHKTJ_OfmYNtt1UYZtDCKy-k1q5ceg_g2Rwd_yML6DcwSmeno=) for the latest updates. 

Note: SharePoint Online in Microsoft 365 is not impacted by CVE-2025-53770. 

**Enable AMSI Integration**

If you are running a publicly exposed, on-premises instance of Microsoft SharePoint and have [Defender AV ](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GFY7Zhpf_MoUNApL34-54hMFrSPFkqo_iYcbHBWB4ol-nUEl69VsylmjKA9kcuW4O0s=)installed, Arctic Wolf strongly recommends enabling [AMSI](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GCVvb4vzKJX9OVpe5sz5IKfEos9-x2AOOrJA6EC9bTwLC21cDa9HCyYl1se6rjrTAH8=) integration in SharePoint and ensuring Defender AV is deployed across all SharePoint servers.

According to Microsoft, this mitigation will block unauthenticated threat actors from exploiting CVE-2025-53770. 

**Disconnect On-Premises SharePoint Servers from the Public Internet**

For customers unable to upgrade to the fixed version of SharePoint or apply AMSI (e.g., those not using Defender AV), Microsoft recommends disconnecting the server from the internet until a security update can be applied. 

**Rotate SharePoint Server ASP.NET Machine Keys**

If your organisation was running a publicly exposed, on-premises instance of Microsoft SharePoint before update applied, it is likely that your SharePoint instance was compromised. By exploiting CVE-2025-53770, threat actors can obtain encryption keys, allowing them to maintain access even if a web shell is removed. As a result, simply removing malicious artifacts may not fully eliminate the threat. If a compromise is detected, isolate the impacted server and rotate the SharePoint MachineKey to revoke the threat actor’s access. 

**Note:** Arctic Wolf recommends following change management best practices for deploying Agent and Sysmon, including testing changes in a testing environment before deploying to production. 

**References**

- - Microsoft Announcement: [https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GI7Al3_CNSe1RbAJ6iCHKTJ_OfmYNtt1UYZtDCKy-k1q5ceg_g2Rwd_yML6DcwSmeno=)
    - Eye Security Article: [https://research.eye.security/sharepoint-under-siege/](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GNTCi7-sN0wKxG7RdC4RWslPNClDhudOc1jDAcIvnisW17ws1IgmisflDeX4M9jIMEc=)
    - Palo Alto Networks Unit 42 Advisory: [https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-07-19-Microsoft-SharePoint-vulnerabilities-CVE-2025-49704-and-49706.txt](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4F158HGSc3_ak6xVA55hDya-KZae1iNvq-3xjA9KjdukyFliV9y8WdJlNo3dNNs2WATw=)
    - The Hacker News Article: [https://thehackernews.com/2025/07/microsoft-releases-urgent-patch-for.html?m=1](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GBuSYlQfDKJzoO7M6LEepocIgBhoWZQkJg4NzlfBr_UB4rMykqbOPyCsUZgbT6owjXk=)
    - PoC Screenshot: [https://x.com/codewhitesec/status/1944743478350557232](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GJpJu85qTt-Qt8z7k9vqjDdtCkUosVmx0hVtjEUvb339eitUt4iy-DGaMXsdy2dA2SI=)
    - Microsoft Advisory (CVE-2025-53770): [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GAvLeRVn9IFpyDYAMYZNb46AH1BRSaRCT5iqKzd5m8CAdg3fW5JWeBQ-TivJRnbXKLM=)
    - Microsoft Advisory (CVE-2025-49706): [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GDuX1zzjJ2esiizvVzY6Z_VBNw3l7y9odXZHARfHl92z1DOB7Y6X-vUaxUbYSDn1FoE=)
    - Microsoft Advisory (CVE-2025-49704): [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GIFDpte-tiZoAjjdmYnK03OPUpazbqkfTntKPeeSmeY-8e8AUQQ8MiufgjrvtzwfVAE=)
    - CISA Adds CVE-2025-53770 to Known Exploited Vulnerabilities Catalog: [https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGbzLS4GFe9ekQIiZkxT2MYsfZb52GBHpBZyFkR1JHJzb3aYh_088u3syK6TlRC_y_QcHsCWJg=) 

Article Information Source: Artic Wolf

If you need further advice or help contact us today: [hello@coolspirit.co.uk](mailto:hello@coolspirit.co.uk)

[View full post](https://www.coolspirit.co.uk/blogs/bulletin-microsoft-sharepoint-on-premises-exploitation)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Alex Raben"
  },
  "dateModified" : "2025-07-23T08:39:00.159Z",
  "datePublished" : "2025-07-23T08:17:56Z",
  "headline" : "Widespread Exploitation against Microsoft SharePoint On-Premises",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1780,
    "url" : "https://f.hubspotusercontent30.net/hubfs/4423734/Arctic%20Wolf%20PR.jpg",
    "width" : 3192
  },
  "mainEntityOfPage" : "https://www.coolspirit.co.uk/blogs/bulletin-microsoft-sharepoint-on-premises-exploitation",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Blog"
  }
}
```