Critical 9.8 KEV + Ransomware

CVE-2025-53770

SharePoint ToolShell Vulnerability Exploited by State-Backed Hackers

Vendor / product: Microsoft SharePoint Server

Event date: 2025-05-16

Public PoC: Yes

First tracked by RiskWire: 2026-08-15

CISA KEV catalog

Added to KEV

2025-07-20 ↗

Federal remediation due

2025-07-21 (426 days overdue)

Ransomware campaign use

Known

CISA description

Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

Required action

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Named threat actors

Linen TyphoonViolet TyphoonStorm-2603APT27APT31

Sources & citations (1)

A 9.8-severity flaw hit hundreds of millions of workers' familiar file-sharing tool, and the two-step trick that handed state-backed hackers total control without a single password gcn.com · 2026-08-15

References

View on NVD ↗ View on MITRE CVE ↗ Search CISA ↗ KEV lookup tool

See CVE-2025-53770 in context

RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.

Book a 20-min demo →