CVE-2025-53770

This vulnerability lets an attacker jump into your SharePoint Server and run their own code from the network. Think of SharePoint like the building’s secure front desk—normally you need a key (login), but here the door can be exploited without a key. If an attacker gets in, they can lock you out (ransomware), steal files, or shut down important services.

This matters if you run Microsoft SharePoint Server—especially the listed on-premises versions such as Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition—and your server can be reached over the network.

This is particularly urgent if your SharePoint is public-facing, because the issue does not require authentication and does not require user interaction. It is most relevant when an attacker can reach the vulnerable SharePoint service from the network; confirmed exploitation is associated with ransomware campaigns (CISA KEV).

This is RED because CISA has added CVE-2025-53770 to KEV with real-world use in ransomware campaigns, meaning attackers are actively targeting this weakness. The vulnerability allows remote code execution without authentication or user interaction, and it’s considered highly likely to be abused.