{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706) · updates",
  "home_page_url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770",
  "feed_url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770/feed.json",
  "description": "Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.",
  "language": "en",
  "_pwn": {
    "slug": "toolshell-sharepoint-cve-2025-53770",
    "severity": "critical",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770/feed.xml",
    "llms": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770/llms.txt",
    "json": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-22-57b53672",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-22-57b53672",
      "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603",
      "content_text": "Storm-2603 deployed Warlock ransomware.\n\nSource: https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/",
      "date_published": "2025-07-22T00:00:00.000Z",
      "external_url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-22-a27eba91",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-22-a27eba91",
      "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV",
      "content_text": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV",
      "date_published": "2025-07-22T00:00:00.000Z",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-20-38899c7b",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-20-38899c7b",
      "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): CISA adds CVE-2025-53770 to KEV and publishes guidance",
      "content_text": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): CISA adds CVE-2025-53770 to KEV and publishes guidance\n\nSource: https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities",
      "date_published": "2025-07-20T00:00:00.000Z",
      "external_url": "https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-19-c80b1900",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-19-c80b1900",
      "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): Microsoft publishes customer guidance for CVE-2025-53770",
      "content_text": "Apply updates, enable AMSI Full Mode, deploy Defender/EDR, rotate ASP.NET machine keys and restart IIS.\n\nSource: https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770",
      "date_published": "2025-07-19T00:00:00.000Z",
      "external_url": "https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-18-5b22e822",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-18-5b22e822",
      "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): Eye Security observes large-scale exploitation of on-prem SharePoint servers",
      "content_text": "Later clarified as the original ToolShell chain (CVE-2025-49706 + CVE-2025-49704).\n\nSource: https://research.eye.security/sharepoint-under-siege/",
      "date_published": "2025-07-18T00:00:00.000Z",
      "external_url": "https://research.eye.security/sharepoint-under-siege/",
      "tags": [
        "critical"
      ]
    }
  ]
}