ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706) ยท updates https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected. en Tue, 22 Jul 2025 00:00:00 GMT ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-22-57b53672 Tue, 22 Jul 2025 00:00:00 GMT critical <p>Storm-2603 deployed Warlock ransomware.</p> <p><a href="https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/">Source</a></p> ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-22-a27eba91 Tue, 22 Jul 2025 00:00:00 GMT critical <p>ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV</p> ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): CISA adds CVE-2025-53770 to KEV and publishes guidance https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-20-38899c7b Sun, 20 Jul 2025 00:00:00 GMT critical <p><a href="https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities">Source</a></p> ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): Microsoft publishes customer guidance for CVE-2025-53770 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-19-c80b1900 Sat, 19 Jul 2025 00:00:00 GMT critical <p>Apply updates, enable AMSI Full Mode, deploy Defender/EDR, rotate ASP.NET machine keys and restart IIS.</p> <p><a href="https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770">Source</a></p> ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706): Eye Security observes large-scale exploitation of on-prem SharePoint servers https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770#2025-07-18-5b22e822 Fri, 18 Jul 2025 00:00:00 GMT critical <p>Later clarified as the original ToolShell chain (CVE-2025-49706 + CVE-2025-49704).</p> <p><a href="https://research.eye.security/sharepoint-under-siege/">Source</a></p>