On July 20, 2025, CISA added CVE-2025-53770 ('ToolShell') in on-premises Microsoft SharePoint to its Known Exploited Vulnerabilities (KEV) catalog [1]. Microsoft concurrently published customer guidance explaining that the flaw is an unauthenticated remote code execution vulnerability [2]. Officials require immediate application of security updates and post-patching actions such as rotating ASP.NET machine keys in accordance with guidance [2].
Backfill: this event became public on Jul 20, 2025 and we added it on Nov 11, 2026. It is not a new event.
CISA Adds SharePoint 'ToolShell' Vulnerability CVE-2025-53770 to Known Exploited Vulnerabilities Catalog
1 min read
- Disclosed
- Jul 20, 2025
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- 100%, higher than 100% of CVEs
- Exploitation and patch status
- Exploited
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Organisations running: Microsoft SharePoint Server (on-premises)
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| Microsoft SharePoint Server (on-premises) | 見 Microsoft 客戶指引所列版本[2] | — | ✗ Unpatched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Source-Supported Details
Immediately install the security updates provided by Microsoft, inspect for suspicious web shells, and rotate keys and review logs in accordance with official guidance [1].
Source excerpt: "Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice." [1].
Source excerpt: "Microsoft has released security updates that fully protect customers using all supported versions of SharePoint affected by CVE-2025-53770 and CVE-2025-53771 ." [2].
References
Official / primary2
- [1]
“Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice.”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.