Microsoft AD FS & SharePoint Zero-Days Actively Exploited

Unpatched on-premises Microsoft SharePoint and Active Directory Federation Services (AD FS) servers are not just vulnerable; they are active targets in a state-sponsored campaign designed to dismantle enterprise authentication and steal cryptographic secrets.

Chinese state-sponsored actors, identified by Microsoft as Linen Typhoon (overlapping with TAG-67), Violet Typhoon (overlapping with RedBravo), and the ransomware-deploying Storm-2603, are actively exploiting a chain of vulnerabilities in SharePoint Server, including the critical unauthenticated remote code execution flaw [CVE-2025-53770](https://nvd.nist.gov/vuln/detail/CVE-2025-53770) (CVSS 9.8). Concurrently, separate actors are exploiting an elevation of privilege zero-day in AD FS, [CVE-2026-56155](https://nvd.nist.gov/vuln/detail/CVE-2026-56155), to gain administrative control over identity infrastructure. The SharePoint flaws were reported by researchers at Mandiant and Google's FLARE team, while Microsoft's own Detection and Response Team (DART) discovered the AD FS exploitation, confirming these are not theoretical risks but weapons in active use.

Note what this means: This is the weaponization of trust. Attackers are not just breaching a server; they are striking the heart of enterprise identity (AD FS) and collaboration (SharePoint). By compromising these on-premises systems, they gain the keys to the kingdom, allowing them to forge authentication claims and move laterally across hybrid environments with impunity. The economic incentive is to maintain a low-and-slow presence inside trusted networks, which is why patching is not a suggestion—it is the only viable response.

[Visual Graphic 1]

Anatomy of an Exploit: The 'ToolShell' SharePoint Chain

The most critical immediate threat is the "ToolShell" exploit chain targeting on-premises SharePoint Server 2016, 2019, and Subscription editions. This is not a single vulnerability, but a sophisticated sequence of flaws that allows a completely unauthenticated attacker on the internet to execute code as the SharePoint service account. The chain's linchpin is CVE-2025-53770, a critical deserialization vulnerability.

Attackers initiate the chain by sending a specially crafted POST request to the `/layouts/15/ToolPane.aspx` endpoint. According to Microsoft's analysis, they leverage an authentication bypass (CVE-2025-53771) and a logic flaw in how the server validates the `Referer` header to push a malicious payload. This technique is an evolution, building on previously patched bugs like CVE-2025-49704 and CVE-2025-49706, demonstrating a persistent effort by adversaries to retain access to this high-value target.

> 🧠 CISO Brief: The primary goal of the SharePoint zero-day exploitation is not just initial access, but the theft of cryptographic material. Attackers have been observed deploying webshells like `spinstall0.aspx` specifically to exfiltrate ASP.NET machine keys from the `web.config` file. With these keys, an attacker can decrypt `ViewState` data, forge authentication cookies, and maintain persistent, stealthy access even after the initial vulnerability is patched. This elevates the incident from a server compromise to a potential tenant-wide identity crisis.

Another actively exploited flaw, [CVE-2026-56164](https://nvd.nist.gov/vuln/detail/CVE-2026-56164), allows an unauthenticated attacker to elevate privileges on SharePoint servers. Both vulnerabilities are now listed in the [CISA Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), mandating immediate patching for federal agencies. For private organizations, this is an unambiguous signal to act now. The existence of multiple, independent exploitation campaigns against SharePoint underscores its value as an initial access vector.

This is a failure of asset management. Any organization running unpatched, internet-facing SharePoint should assume it is compromised.

The Silent Escalation: AD FS Becomes the Endgame

While SharePoint provides the foothold, AD FS provides the kingdom. The active exploitation of CVE-2026-56155 in Active Directory Federation Services represents a catastrophic escalation for any compromised network. This flaw allows a local attacker who has already gained a low-privilege foothold—perhaps via the SharePoint exploit—to elevate their privileges to that of a full administrator on the AD FS server.

AD FS servers are the master authenticators for hybrid cloud environments, issuing the security tokens that grant access to Microsoft 365, Azure, and countless third-party federated applications. An attacker with administrative control of this server can effectively become anyone. They can intercept and modify authentication requests, forge security assertions using techniques like Golden SAML ([MITRE ATT&CK T1606.002](https://attack.mitre.org/techniques/T1606/002/)), and grant themselves persistent access to high-value cloud resources. The vulnerability, a result of insufficient access control granularity, affects all supported versions of Windows Server.

> ⚠️ BreachModal Insight: The attackers who discovered this flaw understood its strategic value. Compromising a file server is a tactical win; compromising the AD FS server is a strategic victory. It transforms a network intrusion into a full-scale identity crisis that is exceptionally difficult to remediate. The fact that Microsoft's own DART team discovered this during an incident response engagement is telling—it was found because it was successfully used to devastating effect.

It is somewhat ironic that the very system designed to centralize and secure authentication has become the single most valuable target for dismantling it. The complexity of AD FS, coupled with its critical role, makes it a brittle and unforgiving part of the infrastructure.

[Visual Graphic 2]

Proof of Concept: Unauthenticated RCE via 'ToolShell' (CVE-2025-53770)

This proof of concept demonstrates the core mechanism of the 'ToolShell' exploit chain against a vulnerable on-premises SharePoint Server. It simulates how an unauthenticated attacker can achieve remote code execution by sending a crafted request to the `ToolPane.aspx` endpoint.

Preconditions: Network access to a vulnerable SharePoint Server (2016, 2019, or Subscription Edition) that has not been patched for CVE-2025-53770 and CVE-2025-53771.

1. Target Identification & Referer Spoofing: The attacker first identifies a valid SharePoint site URL. The key to the authentication bypass is crafting a POST request with a `Referer` header that points back to the target server itself, fooling the server's validation logic.

2. Payload Generation: The core of the exploit is a malicious serialized object. For this PoC, we will represent this with a placeholder, but in a real attack, this would be a carefully constructed gadget chain using a tool like `ysoserial.net` to trigger code execution upon deserialization.

3. Crafting the Malicious Request: The attacker uses a tool like `curl` to send the payload to the vulnerable endpoint. The request must be a `POST` request, contain the spoofed `Referer` header, and have the correct `Content-Type`.

```bash Target SharePoint Server URL TARGET_URL="http://vulnerable-sharepoint.local"

The vulnerable endpoint VULN_ENDPOINT="/layouts/15/ToolPane.aspx?DisplayMode=Edit"

A placeholder for the ysoserial.net generated payload In a real attack, this payload would write a webshell (e.g., spinstall0.aspx) to the web root. SERIALIZED_PAYLOAD='<...malicious serialized object...>';

Execute the exploit curl -i -s -k -X 'POST' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -H "Referer: ${TARGET_URL}/" \ --data-binary "__VIEWSTATE=&__EVENTVALIDATION=&__VIEWSTATEGENERATOR=&ctl00%24PlaceHolderMain%24toolPane%24tabToolPane%24ctl01%24ctl00%24txtUser=test&ctl00%24PlaceHolderMain%24toolPane%24tabToolPane%24ctl01%24ctl00%24proxySerializationData=${SERIALIZED_PAYLOAD}" \ "${TARGET_URL}${VULN_ENDPOINT}" ```

4. Verification: A successful exploit will not return an error. The attacker would then verify execution by attempting to access the dropped webshell, for example, by browsing to `http://vulnerable-sharepoint.local/_layouts/15/spinstall0.aspx`. A `200 OK` response from the webshell confirms successful RCE.

> 🧩 Tactical Note: Detection engineering teams should build rules that look for POST requests to `ToolPane.aspx` that originate from external IP addresses or that contain unusual `Referer` headers. While sophisticated attackers may try to blend in, this specific endpoint is a high-fidelity indicator of compromise for this exploit chain.

FINAL VERDICT

The active exploitation of the SharePoint zero-day (CVE-2025-53770) and the AD FS exploitation flaw (CVE-2026-56155) is a brutal reminder that on-premises infrastructure remains a primary target for elite threat actors. The risk is borne by any organization that has not yet migrated these critical services to the cloud or has failed to maintain a rigorous patching cadence. The core issue is not the existence of vulnerabilities, but the systemic failure to manage complex legacy systems at the speed of modern threats. Organizations must operate under the assumption of compromise, rotate cryptographic keys, enable advanced threat protection like AMSI, and hunt for indicators of exploitation in their logs. Trusting that your on-prem identity server is secure without verification is no longer a viable strategy.

*BreachModal's Adversarial Simulation and Incident Response teams specialize in identifying and neutralizing threats to critical infrastructure. [Contact us](https://www.breachmodal.com/contact) to validate your defenses against these exact attack chains.*