---
id: "CVE-2025-53770"
kind: "vulnerability"
aliases: ["CVE-2025-53770"]
title: "Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Microsoft SharePoint", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": ["16.0.18526.20508"], "affected": "< 16.0.18526.20508", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2016", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2019", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ransomware", "self-hosted", "sharepoint", "vendor", "windows"]
not_affected_if: ["managed-hosting", "sharepoint-online"]
published_at: "2025-07-20T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53770", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to…

Microsoft SharePoint Server on-premises has an unsafe deserialization flaw that lets an unauthenticated attacker run code over the network. It is a patch bypass for CVE-2025-49704 and is being exploited in the wild, including in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft SharePoint affected ? fixed ?
- vendor:microsoft sharepoint server affected < 16.0.18526.20508 fixed 16.0.18526.20508
- vendor:microsoft sharepoint server affected = 2016 fixed ?
- vendor:microsoft sharepoint server affected = 2019 fixed ?

## Fix

Apply the latest Microsoft SharePoint security update that covers CVE-2025-53770, and follow CISA and Microsoft mitigation guidance. Versions past end of life should be disconnected from the internet.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-53770

## From the sources

Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

CISA required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_