Page generated: 09 Nov 2026, 10:49 UTC
← Dashboard

CVE-2025-49706

ToolShell

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 6.5 (MEDIUM) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.5/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 6.5: +0.97
  • Fresh EPSS: 99.06%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 40 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Forkast News
Press · 20 Sep 2026, 07:00 · The Patch Is Not Enough: SharePoint’s ToolShell Chain Steals Keys That Outlive the Fix - Forkast News
TechRepublic
Press · 21 Aug 2026, 21:26 · Patch SharePoint Now: Microsoft Servers at Risk of New ToolShell RCE Attack - TechRepublic
Cybersecurity Dive
Press · 21 Jul 2026, 07:00 · Microsoft SharePoint under attack via new exploit - Cybersecurity Dive
https://tech-insider.org/
Press · 06 Jul 2026, 07:00 · SharePoint Vulnerability CVE-2026-45659 Exploited [2026] - https://tech-insider.org/
Palo Alto Networks
Press · 28 Jan 2026, 08:00 · Intercepting the ToolShell Zero-Day Before the Headlines - Palo Alto Networks
See all 40 source documents
Industrial Cyber
Press · 23 Oct 2025, 07:00 · China-linked hackers exploit ToolShell to hit telecom, government networks globally - Industrial Cyber
Cisco Talos Blog
Press · 23 Oct 2025, 07:00 · IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response - Cisco Talos Blog
SECURITY.COM
Press · 22 Oct 2025, 07:00 · ToolShell Used to Compromise Telecoms Company in Middle East - SECURITY.COM
The Hacker News
Press · 22 Oct 2025, 07:00 · Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch - The Hacker News
Trellix
Press · 04 Sep 2025, 07:00 · ToolShell Unleashed: Decoding the SharePoint Attack Chain - Trellix
Cybersecurity Dive
Press · 08 Aug 2025, 07:00 · Financially motivated cluster a key player in ToolShell exploitation - Cybersecurity Dive
Resecurity
Press · 01 Aug 2025, 07:00 · SharePoint Zero-Day Exploit (ToolShell) - Network Infrastructure Mapping - Resecurity
Unit 42
Press · 31 Jul 2025, 07:00 · Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12) - Unit 42
Securelist
Press · 25 Jul 2025, 07:00 · ToolShell: a story of five vulnerabilities in Microsoft SharePoint - Securelist
SentinelOne
Press · 24 Jul 2025, 07:00 · Defending Against ToolShell: SharePoint’s Latest Critical Vulnerability - SentinelOne
SecurityWeek
Press · 24 Jul 2025, 07:00 · ToolShell Attacks Hit 400+ SharePoint Servers, US Government Victims Named - SecurityWeek
WeLiveSecurity
Press · 24 Jul 2025, 07:00 · ToolShell: An all-you-can-eat buffet for threat actors - WeLiveSecurity
Recorded Future
Press · 23 Jul 2025, 07:00 · ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises - Recorded Future
SentinelOne
Press · 22 Jul 2025, 07:00 · SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers - SentinelOne
The Hacker News
Press · 22 Jul 2025, 07:00 · Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access - The Hacker News
The Record from Recorded Future News
Press · 22 Jul 2025, 07:00 · Chinese nation-state groups exploiting SharePoint vulnerability, Microsoft confirms - The Record from Recorded Future News
Akamai
Press · 22 Jul 2025, 07:00 · Understand the SharePoint RCE: Exploitations, Detections, and Mitigations - Akamai
Bitsight
Press · 22 Jul 2025, 07:00 · ToolShell Threat Brief: SharePoint RCE Vulnerabilities (CVE-2025-53770 & 53771) Explained - Bitsight
www.trendmicro.com
Press · 22 Jul 2025, 07:00 · Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771) - www.trendmicro.com
Microsoft
Press · 22 Jul 2025, 07:00 · Disrupting active exploitation of on-premises SharePoint vulnerabilities - Microsoft
SECURITY.COM
Press · 21 Jul 2025, 09:56 · ToolShell: Critical SharePoint Zero-Day Exploited in the Wild - SECURITY.COM
Sophos
Press · 21 Jul 2025, 07:00 · SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild - Sophos
Krebs on Security
Press · 21 Jul 2025, 07:00 · Microsoft Fix Targets Attacks on SharePoint Zero-Day - Krebs on Security
Kaspersky
Press · 21 Jul 2025, 07:00 · Update Microsoft SharePoint ASAP - Kaspersky
Bitdefender
Press · 21 Jul 2025, 07:00 · Technical Advisory: Critical Remote Code Execution Vulnerability in Microsoft SharePoint Server (CVE-2025-53770) - Bitdefender
wiz.io
Press · 21 Jul 2025, 07:00 · SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know - wiz.io
Rapid7
Press · 21 Jul 2025, 07:00 · CVE-2025-53770 - Zero-day exploitation in the wild of Microsoft SharePoint servers - Rapid7
Cisco Talos Blog
Press · 21 Jul 2025, 07:00 · ToolShell: Details of CVEs affecting SharePoint servers - Cisco Talos Blog
The Hacker News
Press · 21 Jul 2025, 07:00 · Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks - The Hacker News
BleepingComputer
Press · 20 Jul 2025, 07:00 · Microsoft SharePoint zero-day exploited in RCE attacks, no patch available - BleepingComputer
The Hacker News
Press · 20 Jul 2025, 07:00 · Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers - The Hacker News
LinkedIn
Press · 20 Jul 2025, 07:00 · WARNING❗️Critical Vulnerability In Microsoft SharePoint Server - LinkedIn
Help Net Security
Press · 20 Jul 2025, 07:00 · Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770) - Help Net Security
Qualys
Press · 19 Jul 2025, 07:00 · ToolShell Zero-Day: CVE-2025-53770 SharePoint RCE, Patch Now - Qualys
Arctic Wolf
Press · 19 Jul 2025, 07:00 · CVE-2025-53770: Widespread Exploitation of ToolShell RCE Vulnerability Observed in Microsoft SharePoint On-Premises - Arctic Wolf

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.5 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 6.5; EPSS 99.1%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:39.188146+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
08 Jul 2025, 16:58
First press mention
19 Jul 2025, 07:00
Added to the CISA KEV catalog
22 Jul 2025, 00:00
Latest press mention
20 Sep 2026, 07:00
Score calculated
05 Nov 2026, 13:59
Name
ToolShell