Microsoft has issued emergency out-of-band security updates to address two (2) actively exploited zero-day vulnerabilities in on-premises SharePoint Servers tracked as CVE-2025-53770 (a critical remote code execution (RCE) flaw with a CVSS score of 9.8/10) and CVE-2025-53771 (a spoofing flaw rated 6.3/10), which are being weaponized in a global campaign dubbed “ToolShell.” Initially exploited at the Pwn2Own Berlin contest and partially patched in the July 2025 Patch Tuesday, the flaws were found to still be exploitable, allowing attackers to bypass existing defenses. At least fifty-four (54) organizations worldwide including banks, universities, healthcare providers, and government agencies have reportedly been compromised. The threat actors are using these vulnerabilities to gain privileged access, bypass MFA and SSO, steal cryptographic material, implant persistent backdoors, and exfiltrate sensitive data. Microsoft has released updated patches for SharePoint 2019 and Subscription Edition but is still working on fixes for SharePoint 2016.
CTIX analysts strongly advise administrators to immediately install the latest updates, rotate ASP.NET machine keys, enable AMSI, restart IIS services, and investigate environments for signs of compromise such as the presence of spinstall0.aspx or suspicious IIS log entries. Given SharePoint’s deep integration with Microsoft 365 services, experts warn that patching alone is insufficient and that organizations should assume compromise if their servers are exposed to the internet. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-53770 to its Known Exploited Vulnerabilities (KEV) catalog, reinforcing the urgency for immediate mitigation and incident response.