Various cyber security agencies have issued urgent warnings about a critical but currently unpatched in various versions of Microsoft SharePoint Server.
CISA, the US Cyber Defense Agency, warns that: “While the scope and impact continue to be assessed, the new Common Vulnerabilities and Exposures (CVE), CVE-2025-53770, is a variant of the existing vulnerability CVE-2025-49706 and poses a risk to organizations. This exploitation activity, publicly reported as ‘ToolShell’, provides unauthenticated access to systems and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network.”
In CVE-2025-53770 Microsoft states that it is “preparing and fully testing a comprehensive update to address this vulnerability” and lists some interim actions that can be taken.
The Microsoft 365 SharePoint Online version of SharePoint is not impacted by this vulnerability.
Check Point Research states that it identified the first signs of the exploitation on July 7th. Since then, Check Point has confirmed dozens of compromised servers across government, telecommunications, and software sectors in North America and Western Europe.
Industry comments
Rik Ferguson, VP of security intelligence at Forescout:
“CVE-2025-53770 is more than just another SharePoint flaw. It is a case study in what happens when legacy trust models meet modern threat actors. An authenticated user should never be treated as a guaranteed safe entity, but this vulnerability effectively grants code execution without requiring elevated privileges. For CISOs, this highlights a critical point. If your security posture still relies on perimeter trust or the assumption that credentialed access equals safety, then it is time to reassess.
“Zero Trust is not a buzzword. It is a necessity. Security must begin from the premise that every user and every device is untrusted until verified continuously. You need segmentation that limits lateral movement and monitoring that can flag even subtle deviations from expected behaviour. Because attackers are not just getting in. They are already inside. The question is how far they can go once they are there.”
Martin Riley, CTO at Bridewell:
“The mass exploitation of SharePoint servers via CVE-2025-53770 presents an unprecedented risk due to its ability to completely bypass authentication and identity controls like MFA. The absence of a patch means businesses must act now to reduce their attack surface. Disabling or limiting external access to SharePoint is the most effective option. For those unable to do so, deploying advanced anti-malware, enabling Microsoft Defender AV with AMSI, and increasing monitoring for lateral movement are critical. This vulnerability is not just about data theft — it can enable attackers to harvest credentials, steal cryptographic keys, and impersonate users even after the patch is applied unless keys are rotated. Leaders must prioritise mitigations immediately, even if this impacts productivity. The cost of inaction is far greater than the inconvenience of temporary restrictions.”
Thomas Richards, infrastructure security practice director at Black Duck:
“Right now, anyone with an externally facing SharePoint on-premises server is at risk regardless of what industry they are part of. If possible, organizations should restrict access to any externally available vulnerable SharePoint server. Security teams should also add end-point protection software to their SharePoint servers and review system logs for evidence of a compromise as documented by the researchers. Software security is a very difficult problem for organizations to solve. Large codebases which consist of legacy code increase that challenge as the original software wasn’t written with modern secure code guidance. Introducing a fix can sometimes have other implications if the original vulnerability isn’t fully resolved.”
James McQuiggan, Security Awareness Advocate at KnowBe4:
“To avoid unnecessary data loss, potential business interruptions, and reputational damage to their brand, CISOs need to review their exposure and the various mitigation steps they can take. As this is an unpatched vulnerability with confirmed attacks in progress, the real-world exploitation has already started, which raises the urgency. Organizations need to take immediate mitigation steps to reduce the risk of a data breach by cybercriminals and attackers.
“While this vulnerability only impacts SharePoint systems ‘on-prem’, if an organization’s SharePoint is exposed to the Internet, the risk is significantly higher. There’s still a risk if it’s inside the network, as it might have a slower impact, and if attackers are already inside the network, they can target SharePoint to gain access to data and other sensitive information.
“Mitigation steps to consider:
- Evaluate the business impact of downtime versus the risk of compromise.
- They need to limit access to essential users only, and over VPN.
- Utilize their security operations team to increase monitoring of SharePoint for signs of suspicious activity.
- Work with cybersecurity vendors to determine if they’ve identified IOCs of the type of attack.
- Worst case scenario: Isolate the SharePoint server from the Internet or temporarily take it offline.”
