CVE-2025-53760

This vulnerability is a weakness in Microsoft SharePoint where the server can be tricked into doing the wrong kind of network call. If someone already has some level of access, they may be able to use that trick to gain higher privileges than they should. Think of it like an authorized user getting the keys to extra doors by abusing how the building’s intercom system works.

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (sharepoint server). The key point is that the attacker must already be authorized, so the bigger risk is from compromised accounts, overly broad permissions, or insider threats. It’s a network-reachable issue, but only becomes a concern when an attacker can reach the SharePoint services and already has valid access.

Treat this as urgent-but-not-immediate: it’s an elevation-of-privilege problem reachable over the network, with low required authentication and no user interaction needed once an authorized attacker is in play. There’s no indication it’s listed in CISA KEV and no public exploit code was found, but pressure is rising and the likelihood is trending upward. Since SharePoint is commonly tied to business documents and access control, you should prioritize patching soon.

Confirm exposure

1. Identify your SharePoint deployment type: SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition (sharepoint server).
2. Determine the exact SharePoint build/version in your environment (including web front ends and any relevant server roles). Record the build number.
3. Compare against the fixed builds for CVE-2025-53760:
   • 2016 → fixed in 16.0.5513.1002
   • 2019 → fixed in 16.0.10417.20041
   • Subscription Edition / sharepoint server → fixed in 16.0.18526.20518

Patch / upgrade

1. Use Microsoft’s update guidance for CVE-2025-53760 and install the correct update package for your SharePoint version.
2. Apply the update to all required components (commonly including the web front ends; coordinate with your SharePoint admin process for farm updates).
3. After installation, re-check the build number(s) to confirm they are at or above the fixed version listed for your branch.

If patching is delayed (workarounds)

1. Tighten who can access SharePoint and review permissions for accounts with elevated rights.
2. Review recent authentication activity (especially any unusual logins) and closely monitor for unexpected permission changes.
3. Ensure only necessary SharePoint endpoints are exposed, and validate your network access patterns for SharePoint services.

What to monitor after remediation

1. SharePoint audit/security logs for unusual permission changes or privilege-related actions.
2. Alerts indicating atypical server-side behavior tied to SharePoint requests.

KEV / timeline note

CISA KEV does not list this CVE, and no public exploit code is on record in the provided findings.

CVE-2025-53760 is categorized as CWE-918 (Server-Side Request Forgery) leading to an elevation of privilege in Microsoft SharePoint. The findings describe an SSFR-style weakness that can be triggered over the network and does not require user interaction. Authentication requirements are described as low, and exploitation depends on the attacker being authorized. In the findings, CISA KEV does not list this CVE and no public exploit code is recorded, indicating no confirmed widespread active exploitation in the provided data. EPSS is described as predicted with a rising trend; however, because KEV is not present and no exploit code is known, treat this as a “patch soon” scenario rather than assuming active exploitation. Fixes are available as specific SharePoint build numbers for each supported branch listed in the findings.