Page generated: 06 Nov 2026, 03:50 UTC
← Dashboard

CVE-2025-53770

ToolShell

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update t…

Read full description
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 100.00%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 39 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Forkast News
Press · 20 Sep 2026, 07:00 · The Patch Is Not Enough: SharePoint’s ToolShell Chain Steals Keys That Outlive the Fix - Forkast News
TechRepublic
Press · 21 Aug 2026, 21:26 · Patch SharePoint Now: Microsoft Servers at Risk of New ToolShell RCE Attack - TechRepublic
Cybersecurity Dive
Press · 21 Jul 2026, 07:00 · Microsoft SharePoint under attack via new exploit - Cybersecurity Dive
CyberSecurityNews
Press · 08 Jul 2026, 07:00 · PoC and Technical Details Released for SharePoint Remote Code Execution Vulnerability - CyberSecurityNews
https://tech-insider.org/
Press · 06 Jul 2026, 07:00 · SharePoint Vulnerability CVE-2026-45659 Exploited [2026] - https://tech-insider.org/
See all 39 source documents
Palo Alto Networks
Press · 28 Jan 2026, 08:00 · Intercepting the ToolShell Zero-Day Before the Headlines - Palo Alto Networks
Industrial Cyber
Press · 23 Oct 2025, 07:00 · China-linked hackers exploit ToolShell to hit telecom, government networks globally - Industrial Cyber
Cisco Talos Blog
Press · 23 Oct 2025, 07:00 · IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response - Cisco Talos Blog
SECURITY.COM
Press · 22 Oct 2025, 07:00 · ToolShell Used to Compromise Telecoms Company in Middle East - SECURITY.COM
Trellix
Press · 04 Sep 2025, 07:00 · ToolShell Unleashed: Decoding the SharePoint Attack Chain - Trellix
Cybersecurity Dive
Press · 08 Aug 2025, 07:00 · Financially motivated cluster a key player in ToolShell exploitation - Cybersecurity Dive
Check Point Research
Press · 31 Jul 2025, 07:00 · Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations - Check Point Research
Unit 42
Press · 31 Jul 2025, 07:00 · Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12) - Unit 42
Securelist
Press · 25 Jul 2025, 07:00 · ToolShell: a story of five vulnerabilities in Microsoft SharePoint - Securelist
SecurityWeek
Press · 24 Jul 2025, 07:00 · ToolShell Attacks Hit 400+ SharePoint Servers, US Government Victims Named - SecurityWeek
SentinelOne
Press · 24 Jul 2025, 07:00 · Defending Against ToolShell: SharePoint’s Latest Critical Vulnerability - SentinelOne
CyberScoop
Press · 24 Jul 2025, 07:00 · Microsoft SharePoint attacks ensnare 400 victims, including federal agencies - CyberScoop
WeLiveSecurity
Press · 24 Jul 2025, 07:00 · ToolShell: An all-you-can-eat buffet for threat actors - WeLiveSecurity
Recorded Future
Press · 23 Jul 2025, 07:00 · ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises - Recorded Future
SentinelOne
Press · 22 Jul 2025, 07:00 · SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers - SentinelOne
Microsoft
Press · 22 Jul 2025, 07:00 · Disrupting active exploitation of on-premises SharePoint vulnerabilities - Microsoft
www.trendmicro.com
Press · 22 Jul 2025, 07:00 · Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771) - www.trendmicro.com
Akamai
Press · 22 Jul 2025, 07:00 · Understand the SharePoint RCE: Exploitations, Detections, and Mitigations - Akamai
Cloudflare Blog
Press · 22 Jul 2025, 07:00 · Cloudflare protects against critical SharePoint vulnerability, CVE-2025-53770 - Cloudflare Blog
Bitsight
Press · 22 Jul 2025, 07:00 · ToolShell Threat Brief: SharePoint RCE Vulnerabilities (CVE-2025-53770 & 53771) Explained - Bitsight
SECURITY.COM
Press · 21 Jul 2025, 09:56 · ToolShell: Critical SharePoint Zero-Day Exploited in the Wild - SECURITY.COM
Sophos
Press · 21 Jul 2025, 07:00 · SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild - Sophos
Dark Reading
Press · 21 Jul 2025, 07:00 · Microsoft Rushes Emergency Fix for Exploited SharePoint Bug - Dark Reading
Kaspersky
Press · 21 Jul 2025, 07:00 · Update Microsoft SharePoint ASAP - Kaspersky
Rapid7
Press · 21 Jul 2025, 07:00 · CVE-2025-53770 - Zero-day exploitation in the wild of Microsoft SharePoint servers - Rapid7
SOC Prime
Press · 21 Jul 2025, 07:00 · CVE-2025-53770 Detection: Microsoft SharePoint Zero-Day Vulnerability Is Actively Exploited for RCE Attacks - SOC Prime
wiz.io
Press · 21 Jul 2025, 07:00 · SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know - wiz.io
Cisco Talos Blog
Press · 21 Jul 2025, 07:00 · ToolShell: Details of CVEs affecting SharePoint servers - Cisco Talos Blog
Bitdefender
Press · 21 Jul 2025, 07:00 · Technical Advisory: Critical Remote Code Execution Vulnerability in Microsoft SharePoint Server (CVE-2025-53770) - Bitdefender
Help Net Security
Press · 20 Jul 2025, 07:00 · Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770) - Help Net Security
The Hacker News
Press · 20 Jul 2025, 07:00 · Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers - The Hacker News
BleepingComputer
Press · 20 Jul 2025, 07:00 · Microsoft SharePoint zero-day exploited in RCE attacks, no patch available - BleepingComputer
Qualys
Press · 19 Jul 2025, 07:00 · ToolShell Zero-Day: CVE-2025-53770 SharePoint RCE, Patch Now - Qualys
Arctic Wolf
Press · 19 Jul 2025, 07:00 · CVE-2025-53770: Widespread Exploitation of ToolShell RCE Vulnerability Observed in Microsoft SharePoint On-Premises - Arctic Wolf

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.0 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

7

Public exploit entries / repo candidates

See 7 repos with metrics
RepositoryStarsForksLanguageUpdated
hazcod/CVE-2025-537704512Go10 Feb 2026, 04:09
kaizensecurity/CVE-2025-537704420—21 Jul 2025, 13:52
unk9vvn/sharepoint-toolpane63Python26 Jul 2025, 13:35
exfil0/CVE-2025-5377051Python23 Jul 2025, 21:21
Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC40C#29 Jul 2025, 14:28
J4ck3LSyN-Gen2/CVE-2025-5377021Python21 Mar 2026, 15:12
harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC10—02 Aug 2025, 08:11
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 100.0%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:41.296531+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
19 Jul 2025, 07:00
Added to the CISA KEV catalog
20 Jul 2025, 00:00
Published
20 Jul 2025, 01:06
Latest press mention
20 Sep 2026, 07:00
Score calculated
05 Nov 2026, 13:59
Name
ToolShell
PoCs on GitHub
7 repositories