ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)
Microsoft SharePoint Server (on-premises)
Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.
Why this severity: Unauthenticated RCE chain; mass exploitation; CISA KEV; known ransomware use (Warlock)
- Started
- Jul 18, 2025
- Closed
- Jul 22, 2025
Affected
- On-premises SharePoint Server (see Microsoft customer guidance for the exact builds)
Fixed in
- See Microsoft customer guidance for CVE-2025-53770
Timeline5
Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603
Storm-2603 deployed Warlock ransomware.
SourceCISA adds CVE-2025-49704 and CVE-2025-49706 to KEV
CISA adds CVE-2025-53770 to KEV and publishes guidance
SourceMicrosoft publishes customer guidance for CVE-2025-53770
Apply updates, enable AMSI Full Mode, deploy Defender/EDR, rotate ASP.NET machine keys and restart IIS.
SourceEye Security observes large-scale exploitation of on-prem SharePoint servers
Later clarified as the original ToolShell chain (CVE-2025-49706 + CVE-2025-49704).
Source
Advisories7
- Customer guidance for SharePoint vulnerability CVE-2025-53770Microsoft · Jul 19, 2025
- UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint VulnerabilitiesCISA · Jul 20, 2025
- Joint Statement on SharePoint vulnerabilitiesENISA
- NVD: CVE-2025-53770NVD
- NVD: CVE-2025-49704NVD
- NVD: CVE-2025-49706NVD
- CISA Known Exploited Vulnerabilities CatalogCISA · Jul 20, 2025
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
