{"id":"CVE-2025-53770","kind":"vulnerability","aliases":["CVE-2025-53770"],"related":[],"title":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to…","description":"Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.\n\nCISA required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","summary":"Microsoft SharePoint Server on-premises has an unsafe deserialization flaw that lets an unauthenticated attacker run code over the network. It is a patch bypass for CVE-2025-49704 and is being exploited in the wild, including in ransomware campaigns.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-07-20T00:00:00+00:00","products":[{"name":"Microsoft SharePoint","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":["16.0.18526.20508"],"affected":"< 16.0.18526.20508","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":[],"affected":"= 2016","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":[],"affected":"= 2019","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ransomware","self-hosted","sharepoint","vendor","windows"],"not_affected_if":["managed-hosting","sharepoint-online"],"how_to_check":null,"fix":"Apply the latest Microsoft SharePoint security update that covers CVE-2025-53770, and follow CISA and Microsoft mitigation guidance. Versions past end of life should be disconnected from the internet.","status":"open","published_at":"2025-07-20T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:43+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:46:43Z","model":"claude-haiku-5-5","output":{"fix":"Apply the latest Microsoft SharePoint security update that covers CVE-2025-53770, and follow CISA and Microsoft mitigation guidance. Versions past end of life should be disconnected from the internet.","reach":"internet","summary":"Microsoft SharePoint Server on-premises has an unsafe deserialization flaw that lets an unauthenticated attacker run code over the network. It is a patch bypass for CVE-2025-49704 and is being exploited in the wild, including in ransomware campaigns.","category":"vendor","who_cares":["sharepoint","self-hosted","windows"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the SharePoint server over the network","analyst_note":"Get exact patched build numbers and the Microsoft mitigation steps (e.g. AMSI and ViewState settings) from the Microsoft Security Response Center advisory for CVE-2025-53770.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["sharepoint-online","managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2730,"output_tokens":414,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':207C '-2025':17A,20A,69B,114C,117C,125C,132C,142C '-49704':70B,126C,143C '-53770':18A,21A,118C,133C '-53771':115C '2013':174C '22':206C 'accord':185C 'action':146C 'adher':201C 'allow':12A,97C 'applic':204C 'attack':15A,56B,100C 'avail':222C 'bod':205C 'bypass':66B,122C 'campaign':81B 'chain':111C 'cisa':144C,187C 'cloud':210C 'code':58B,103C 'contain':88C 'could':96C,109C 'cve':16A,19A,68B,113C,116C,124C,131C,141C 'data':4A,93C 'deseri':1A,50B,90C 'disconnect':147C 'discontinu':213C 'earlier':176C 'end':160C,166C 'end-of-lif':159C 'end-of-servic':165C 'eo':169C 'eol':163C 'execut':102C 'exploit':33B,74B 'face':150C 'flaw':51B 'follow':182C 'guidanc':208C 'host':37B 'includ':78B,134C,171C 'instruct':195C 'let':53B 'life':162C 'list':189C,197C 'microsoft':9A,22A,24A,27A,30A,41B,82C 'mitig':184C,219C 'network':61B,106C 'note':192C,200C 'on-premis':6A,44B,85C 'patch':65B,121C 'pleas':181C 'premis':8A,46B,87C 'product':217C 'protect':137C 'public':149C 'public-fac':148C 'ransomwar':34B,80B 'reach':157C 'requir':145C 'robust':136C 'run':57B 'self':36B 'self-host':35B 'server':11A,26A,29A,32A,43B,84C,154C,173C 'servic':168C,211C 'sharepoint':10A,23A,25A,28A,31A,38B,42B,83C,153C,172C 'support':179C 'unauthent':55B 'unauthor':14A,99C 'unsaf':49B 'untrust':3A,92C 'updat':129C 'url':188C,196C 'use':214C 'vendor':39B,194C 'version':151C,177C,180C 'vulner':94C,108C 'wild':77B 'window':40B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-07-20T00:00:00+00:00","kev":{"dateAdded":"2025-07-20","dueDate":"2025-07-21","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-53770","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770","severity":null,"published_at":"2025-07-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-53770","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53770","severity":null,"published_at":"2025-07-20T01:15:30+00:00","modified_at":"2026-08-04T05:16:34+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}