Microsoft Zero-Day Vulnerabilities CVE-2025-53770 & CVE-2025-53771

THE THREAT

[UPDATE July 22, 2025]

• Microsoft has released patches (KB5002760 and KB5002759) for SharePoint Enterprise Server 2016
• Mutiple Proof-of-Concept (PoC) have become available for CVE-2025-53770
• eSentire has observed exploitation attempts for CVE-2025-53770 in multiple customer’s environment with earliest observation tracked back to July 17th
• eSentire assesses with high confidence that exploitation would increase significantly following public disclosure
• Additional Indicators of Compromise have been added to the eSentire Threat Intelligence Feed

Microsoft has disclosed two critical zero-day vulnerabilities (CVE-2025-53770 and CVE-2025-53771) in SharePoint Server that are being actively exploited since July 18th, 2025. These vulnerabilities enable unauthenticated Remote Code Execution (RCE) and represent bypass methods for previously patched flaws (CVE-2025-49704 and CVE-2025-49706), from the July 2025 security updates. The exploitation chain, originally demonstrated as "ToolShell" at Pwn2Own Berlin, has been weaponized by threat actors, resulting in more than 85 compromised SharePoint servers affecting 54 organizations worldwide. Notably impacted entities include federal governments, health organizations, state institutions, energy sector operators, educational institutions, and financial technology companies, according to the security company Eye Security that first identified the attack. Microsoft notes that the vulnerabilities only apply to on-premises SharePoint servers, and do not impact SharePoint Online in Microsoft 365.

To mitigate the risk, Microsoft recommends installing the latest SharePoint security updates, enabling Antimalware Scan Interface (AMSI) integration, and deploying Microsoft Defender for Endpoint or equivalent EDR product on all SharePoint servers. For systems without available patches, administrators are advised to disconnect their SharePoint servers from the Internet. The exploitation involves attackers uploading a malicious file named "spinstall0.aspx" to steal the server's MachineKey configuration, which allows them to execute remote code. CISA has added CVE-2025-53770 to its Known Exploited Vulnerability catalog, giving federal agencies one day to apply patches when released, highlighting the severity of the situation.

What we’re doing about it

• eSentire's Threat Response Unit (TRU) is actively tracking this topic and is evaluating the creation of threat detections related to CVE-2025-53770
• eSentire Threat Response Unit (TRU) is conducting threat hunts to identify signs of CVE-2025-53770 exploitation
  • Impacted organizations are notified via eSentire’s SOC
• eSentire MDR for Network & MDR for Endpoint have detections in place to identify successful exploitation of CVE-2025-53770
• eSentire MDR for Network detects ASP.NET __VIEWSTATE Deserialization attacks
• Known malicious IPs have been added to the eSentire Global Deny list
• Known Indicators of Compromise have been added to the eSentire Threat Intelligence Feed
• eSentire’s Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to both CVE-2025-53770 and CVE-2025-53771

What you should do about it

• Apply available security patches immediately
  • The KB5002754 update for Microsoft SharePoint Server 2019
  • The KB5002768 update for Microsoft SharePoint Subscription Edition
  • The KB5002760 update for Microsoft SharePoint Enterprise Server 2016
  • The KB5002759 update for Microsoft SharePoint Enterprise Server 2016 Language Pack
• Enable AMSI integration
• Ensure EDR is deployed on all SharePoint servers
• Rotate SharePoint Server ASP.NET machine keys post-update
• For unpatched systems, implement network isolation until patches are available
• Organizations should monitor for indicators of compromise, particularly the presence of "spinstall0.aspx" in the SharePoint layouts directory

Additional information

Microsoft has released emergency security patches addressing two critical vulnerabilities affecting on-premises SharePoint servers. The primary concern, CVE-2025-53770 (CVSS: 9.8), enables Remote Code Execution through untrusted data deserialization, while CVE-2025-53771 (CVSS: 6.3) represents a path traversal vulnerability allowing network-based spoofing by authorized attackers. These vulnerabilities are particularly significant as they bypass previous security fixes implemented in the July 2025 Patch Tuesday updates. Both the Canadian Centre for Cyber Security (CCCS) and U.S. CISA have issued urgent advisory warnings due to active exploitation in the wild.

The attack methodology demonstrates sophisticated exploitation techniques, beginning with crafted POST requests to "_layouts/15/ToolPane.aspx" with specific HTTP referrer manipulation. Upon successful exploitation, attackers deploy a malicious file ("spinstall0.aspx") and compromise the ASP.NET ViewState mechanism by extracting the server's MachineKey configuration. This enables attackers to generate valid but malicious __VIEWSTATE payloads using tools like ysoserial, potentially leading to full system compromise. Microsoft has released critical updates (KB5002754 for SharePoint Server 2019 and KB5002768 for SharePoint Subscription Edition), though SharePoint 2016 patches remain pending.

This is not the first time ASP.NET machine keys have been targeted by threat actors. In December 2024, the Microsoft Threat Intelligence team identified an attack where an unattributed threat actor was exploiting publicly available ASP.NET machine keys to perform ViewState code injection attacks. The attack involves using exposed ValidationKey and DecryptionKey values to craft malicious ViewState data that can be sent to websites via POST requests. When processed by ASP.NET Runtime, this allows for remote code execution on the target IIS web server. Since then, Microsoft has identified over 3,000 publicly disclosed keys that could be vulnerable to this type of attack. 

The ViewState code injection attack exploits ASP.NET's machine key system by leveraging exposed ValidationKey and DecryptionKey values. These keys, normally used for ViewState validation and encryption, can be compromised when developers inadvertently use publicly available keys from code repositories or documentation. Attackers can use these known keys to craft malicious ViewState payloads that, when sent via POST requests, are automatically trusted and processed by the ASP.NET Runtime since they contain valid cryptographic signatures.

Organizations are strongly advised to implement immediate mitigation measures, including applying available patches, implementing network isolation for unpatched systems, enhancing monitoring for suspicious POST requests, and deploying additional security controls such as AMSI integration and EDR. These actions should be prioritized due to SharePoint's critical role in business operations and its common exposure to external networks, making it an attractive target for initial network compromise attempts. Note that while on-premises installations are affected, SharePoint Online in Microsoft 365 remains secure against these vulnerabilities.

References:

[1] https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
[2] https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/
[3] https://www.cyber.gc.ca/en/alerts-advisories/al25-009-vulnerability-impacting-microsoft-sharepoint-server-cve-2025-53770
[4] https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
[5] https://research.eye.security/sharepoint-under-siege/
[6] https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/
[7] https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/
[8] https://nvd.nist.gov/vuln/detail/CVE-2025-53771
[9] https://nvd.nist.gov/vuln/detail/CVE-2025-49704
[10] https://nvd.nist.gov/vuln/detail/CVE-2025-49706
[11] https://github.com/microsoft/mstic/blob/master/RapidReleaseTI/MachineKeys.csv
[12] https://github.com/frohoff/ysoserial
[13] https://x.com/codewhitesec/status/1944743478350557232
[14] https://www.esentire.com/what-we-do/threat-response-unit/threat-intelligence-services
[15] https://github.com/soltanali0/CVE-2025-53770-Exploit
[16] https://github.com/kaizensecurity/CVE-2025-53770
[17] https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/
[18] https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html
[19] https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/