CVE-2025-53770 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-53770CRITICAL

Microsoft SharePoint Server Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS    %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9998   100.0   YES

AFFECTED
  Product                                           Versions  Fixed
  Microsoft SharePoint Enterprise Server 2016       16.0.0 –  —
  Microsoft SharePoint Server 2019                  16.0.0 –  —
  Microsoft SharePoint Server Subscription Edition  16.0.0 –  —

TIMELINE
  Jul 9   Reserved by microsoft
  Jul 20  Added to CISA KEV, remediation due 2025-07-21
  Jul 20  Published (CNA: microsoft)
  Aug 4   EXPLOIT PUBLISHED — CVE-2025-53770 (Microsoft SharePoint Enterprise Server 2016). Public exploit reference added.

CWE-502 · CNA: microsoft · CVSS v3.1 · 13 references · NVD status: Analyzed · KEV due July 21, 2025

Description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
July 9, 2025	Reserved	Reserved by microsoft
July 20, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-07-21
July 20, 2025	Published	Published (CNA: microsoft)
August 4, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-53770 (Microsoft SharePoint Enterprise Server 2016). Public exploit reference added.

Affected

Affected products and packages — 3 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Microsoft	Microsoft SharePoint Enterprise Server 2016	—	16.0.0	—
Microsoft	Microsoft SharePoint Server 2019	—	16.0.0	—
Microsoft	Microsoft SharePoint Server Subscription Edition	—	16.0.0	—

Weaknesses

CWE-502

References (13)

https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/ [Exploit, Press/Media Coverage]
https://github.com/kaizensecurity/CVE-2025-53770 [Exploit]
https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ [Mitigation, Vendor Advisory]
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 [Vendor Advisory]
https://news.ycombinator.com/item?id=44629710 [Issue Tracking]
https://research.eye.security/sharepoint-under-siege/ [Exploit, Mitigation, Third Party Advisory]
https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally [Press/Media Coverage]
https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/ [Press/Media Coverage]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770 [US Government Resource]
https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 [Mailing List, Third Party Advisory, US Government Resource]
https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw [Press/Media Coverage]
https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/ [Press/Media Coverage]
https://x.com/Shadowserver/status/1946900837306868163 [Third Party Advisory]

Authoritative record: CVE-2025-53770 at cve.org

Vendors: microsoft

Weaknesses: CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-53770 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.