CVE-2025-53770: Microsoft SharePoint Server deserialization of untrusted data

CVE-2025-53770 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-07-20

Microsoft SharePoint Server, a widely used platform for document management and collaboration, contains a critical security flaw that allows unauthorized attackers to take control of the server. By sending malicious data over the network, an attacker can execute arbitrary commands, potentially leading to the theft of sensitive corporate data, service outages, or a foothold for further attacks within the organization. This vulnerability is currently being exploited in the wild, and organizations are advised to apply mitigations immediately as a full patch may not yet be available for all versions.

Technologies: Microsoft SharePoint, Microsoft SharePoint Server. Vendors: Microsoft.

Quick answers

Is CVE-2025-53770 exploited in the wild?
Yes. CVE-2025-53770 is known to be exploited in the wild, first recorded on 20 July 2025. Treat it as urgent.
How severe is CVE-2025-53770?
Critical severity, with a CVSS score of 9.8, published 20 July 2025.
Which products and versions are affected?
Microsoft SharePoint Server On-premises versions (including 2013 and later).
Is there a fix for CVE-2025-53770?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-53770 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-53770?
Check whether you run Microsoft SharePoint or Microsoft SharePoint Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (CVE-2025-53770) is a deserialization of untrusted data flaw (CWE-502) in on-premises Microsoft SharePoint Server. It functions as a patch bypass for a previous vulnerability (CVE-2025-49704) and can be chained with other vulnerabilities like CVE-2025-53771 for full system compromise. An unauthenticated attacker can exploit this over the network without user interaction to achieve remote code execution (RCE). The vulnerability is actively exploited in the wild. Recommended mitigations include enabling Antimalware Scan Interface (AMSI) integration, deploying Defender AV, and disconnecting end-of-life versions (such as SharePoint 2013) from the internet.

Affected products

  • Microsoft SharePoint Server On-premises versions (including 2013 and later)

Timeline

  • 2025-07-20: disclosed
  • 2025-07-20: advisory: Microsoft and CISA released guidance on exploitation
  • 2025-07-20: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-07-20: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.