SharePoint on-premises 0-Day in active exploitation

Rod-IT · 2025-07-20T17:24:40.406Z

A sophisticated cyberattack campaign targeting Microsoft SharePoint servers has been discovered exploiting a newly weaponized vulnerability chain dubbed “ToolShell,” enabling attackers to gain complete remote control over vulnerable systems without authentication.

Cybersecurity and Infrastructure Security Agency CISA

Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability...

This has been active a few days, but as a heads up, if you have an on-premises SharePoint, please patch and look for IoCs.

There is currently no fix, but there are workarounds.

Rod-IT · 2025-07-21T08:44:08.567Z

Fix has been released

Customer guidance for SharePoint vulnerability CVE-2025-53770 | MSRC Blog | Microsoft Security Response Center

Jay-Updegrove · 2025-07-21T14:55:21.303Z

Thank you for posting this!