CVE-2025-53770

This vulnerability lets an attacker jump into your SharePoint Server and run their own code from the network. Think of SharePoint like the building’s secure front desk—normally you need a key (login), but here the door can be exploited without a key. If an attacker gets in, they can lock you out (ransomware), steal files, or shut down important services.

This matters if you run Microsoft SharePoint Server—especially the listed on-premises versions such as Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition—and your server can be reached over the network.

This is particularly urgent if your SharePoint is public-facing, because the issue does not require authentication and does not require user interaction. It is most relevant when an attacker can reach the vulnerable SharePoint service from the network; confirmed exploitation is associated with ransomware campaigns (CISA KEV).

This is RED because CISA has added CVE-2025-53770 to KEV with real-world use in ransomware campaigns, meaning attackers are actively targeting this weakness. The vulnerability allows remote code execution without authentication or user interaction, and it’s considered highly likely to be abused.

1. Inventory and exposure check (do this first)

   • Identify which product you run: sharepoint server, Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or Microsoft SharePoint Enterprise Server 2016.
   • Determine your exact installed build/version.
   • Confirm whether the SharePoint server is reachable from the internet (public-facing), e.g., through firewall/NAT/DNS, load balancers, or reverse proxies.

2. Decide immediately based on support status

   • If you run SharePoint Server 2013 or earlier (EOL/EOS), follow CISA’s KEV instruction to disconnect public-facing versions that have reached EOL/EOS. This includes disconnecting from the internet to reduce reachability.
   • For supported versions, proceed to step 3.

3. Patch to the fixed versions

   • Upgrade to the fixed build matching your edition:
     • sharepoint server: fixed in 16.0.18526.20508
     • Microsoft SharePoint Enterprise Server 2016: fixed in 16.0.5513.1001
     • Microsoft SharePoint Server 2019: fixed in 16.0.10417.20037
     • Microsoft SharePoint Server Subscription Edition: fixed in 16.0.18526.20508
   • Use Microsoft’s update guidance and your normal change-control process. Re-validate after updating that the intended configuration is still applied.

4. If you cannot patch right away: apply mitigations

   • Apply the mitigation guidance published by Microsoft for CVE-2025-53770 until you can upgrade.
   • Re-check that mitigations remain effective after any maintenance, configuration changes, or patch cycles.

5. Confirm you’re protected

   • After patching/mitigation, confirm SharePoint build/version is the target fixed build (where applicable).
   • Monitor for signs of compromise and follow any additional Microsoft guidance linked for this CVE.

6. Timing / CISA due date

   • CISA KEV remediation due date: 2025-07-21.

What to monitor after changes

• Unexpected authentication attempts and service restarts.
• Indicators of ransomware activity (e.g., unusual encryption behavior, widespread file changes) and unusual processes spawned by SharePoint.
• Any alerts from endpoint/network monitoring around the SharePoint server IP/hostname.

Severity: Critical (CVSS 9.8) with remote, unauthenticated impact.

Weakness type: CWE-502 (improper deserialization of untrusted data).

Mechanism / attack vector: An unauthorized attacker can send crafted network requests that cause SharePoint Server to deserialize untrusted data in a way that permits remote code execution. No authentication and no user interaction are required.

Exploitation status: Listed in CISA KEV (added 2025-07-20) with required action due by 2025-07-21; described as used in ransomware campaigns. Microsoft indicates exploits exist in the wild.

Exploit maturity: Public proof-of-concept exists (3 known public PoCs).

EPSS: A prediction indicated extremely high likelihood and rising trend, but KEV-confirmed exploitation is the controlling signal for urgency.

KEV meaning here: CISA KEV entries represent vulnerabilities that are actively exploited in the real world; CISA expects customers to take specific remediation actions by the due date.