CVE-2025-53771

Microsoft SharePoint Server Spoofing Vulnerability

Exploitation likely. EPSS gives it a 100% chance of exploitation in the next 30 days. Fixed versions are out.

CVSS 3.16.5Medium EPSS percentile99th100% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix4 products3 fixed builds listed below

Published 2025-07-20Updated 2025-08-14Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft SharePoint Enterprise Server 2016Affected: ≥ 16.0.0, < 16.0.5513.1001Upgrade to: 16.0.5513.1001Stated by: CVE record
Microsoft SharePoint Server 2019Affected: ≥ 16.0.0, < 16.0.10417.20037Upgrade to: 16.0.10417.20037Stated by: CVE record
Microsoft SharePoint Server Subscription EditionAffected: ≥ 16.0.0, < 16.0.18526.20508Upgrade to: 16.0.18526.20508Stated by: CVE record
Microsoft Sharepoint ServerAffected: < 16.0.18526.20508Upgrade to: 16.0.18526.20508Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which SharePoint product and version you are running (Enterprise Server 2016, Server 2019, or Subscription Edition) — this only applies to on-premises installs, not SharePoint Online.
If you're unsure whether your SharePoint server is exposed to the internet, ask your IT provider — this is the main factor in how exploitable it is.
Update Microsoft SharePoint Enterprise Server 2016 to version 16.0.5513.1001 or later.
Update Microsoft SharePoint Server 2019 to version 16.0.10417.20037 or later.
Update Microsoft SharePoint Server Subscription Edition to version 16.0.18526.20508 or later.
After patching, have IT check for signs of prior compromise (unusual accounts, unexpected files, or ransomware tools), since attacks on this flaw started before patches existed.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

In plain language

Written by AI from the record

This is a flaw in on-premises Microsoft SharePoint servers that lets attackers impersonate legitimate users without logging in, and it's already being actively used by ransomware criminals — if you run SharePoint Server on your own hardware, you should treat this as urgent.

Improper authentication (CWE-287) in on-premises Microsoft SharePoint Server allows an unauthenticated network attacker to spoof/impersonate other users or systems, and this flaw is being actively exploited in the wild as part of the 'ToolShell' campaign to deploy ransomware.

If you're affected

Ransomware deployment
Unauthorized access as legitimate users
Full server compromise
Operational disruption
Sensitive document exposure

What is it

Think of SharePoint like an internal filing and collaboration system your company uses to store and share documents. This flaw is like a faulty ID checkpoint at the front door — someone can walk in claiming to be a trusted coworker or system without actually proving who they are. Criminal groups have already used this exact trick to break into servers and plant ransomware.

Who is affected

This matters to you if you run Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition on your own servers (not Microsoft's cloud-hosted SharePoint Online). It's especially a risk if that server can be reached from the internet, since no password or login is needed to exploit it.

How urgent is it

Attackers are already exploiting this flaw right now — ransomware groups including Warlock have used it to break into dozens of organizations' SharePoint servers and deploy ransomware, with at least 85 servers compromised before patches were even available. This is not a theoretical risk; it is an active, ongoing attack campaign, so action should not wait.

What to do — in detail

Inventory all on-premises SharePoint Server instances (2016, 2019, Subscription Edition) — SharePoint Online in Microsoft 365 is not affected.
Determine internet-facing exposure; any externally reachable SharePoint Server should be treated as highest priority regardless of current CVSS score, given confirmed exploitation.
Apply vendor fixes: Enterprise Server 2016 → 16.0.5513.1001; Server 2019 → 16.0.10417.20037; Subscription Edition → 16.0.18526.20508. Full guidance: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771.
Because active exploitation (ToolShell/Warlock campaign) predates patch availability (reported July–August), perform compromise assessment post-patch: check for webshells, unexpected service accounts, EDR-killer tooling, and lateral movement indicators.
Not currently listed in CISA KEV, but treat with KEV-equivalent urgency given confirmed ransomware use; no official workaround beyond patching and restricting network exposure (e.g., placing SharePoint behind VPN/WAF, disabling unneeded external access) until patched.
Monitor for IOCs associated with Warlock/Storm-2603/Linen Typhoon/Violet Typhoon actors and rotate machine keys/service account credentials post-incident per Microsoft guidance.

Technical context

CVSS 3.1 base score 6.5 (Medium: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), weakness class CWE-287 (Improper Authentication) enabling spoofing/impersonation over the network with no authentication or user interaction required. Exploit maturity is high — active exploitation confirmed in news reporting as part of the 'ToolShell' campaign, used by Warlock (Longlegs/Storm-2603), Linen Typhoon, and Violet Typhoon to deploy ransomware and EDR-killer tooling against at least 85 servers globally before patches were available. Not currently in CISA KEV at time of writing despite confirmed in-the-wild use; predictive exploitation-likelihood modeling placed this at the highest percentile, consistent with observed real-world activity.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

100% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 340 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2026-06-22EPSS band changemoderate → critical
2026-03-06Nuclei check added
2025-08-14Patch availablerecord updated
2025-07-20Publishedweakness classified, att&ck mapped

Affected products

Microsoft Corpcommercial · USaka Microsoft, microsoft corporation
- Microsoft SharePoint Enterprise Server 2016Web AppOn-premEnterprise Software / document-mgmt
- Microsoft SharePoint Server 2019Web AppOn-premEnterprise Software / document-mgmt
- Microsoft SharePoint Server Subscription EditionWeb AppOn-premEnterprise Software / document-mgmt
- sharepoint serverWeb AppOn-premEnterprise Software / collaboration-groupware

And 3 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact