{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "toolshell",
    "label": "ToolShell",
    "isStack": false,
    "url": "https://pwn.watch/t/toolshell",
    "feed": "https://pwn.watch/t/toolshell/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "toolshell-sharepoint-cve-2025-53770",
      "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770",
      "json": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Microsoft SharePoint Server (on-premises)",
      "tags": [
        "toolshell",
        "microsoft",
        "sharepoint",
        "zero-day",
        "rce",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-49704",
        "CVE-2025-49706",
        "CVE-2025-53770"
      ],
      "affectedVersions": [
        "On-premises SharePoint Server (see Microsoft customer guidance for the exact builds)"
      ],
      "fixedVersions": [
        "See Microsoft customer guidance for CVE-2025-53770"
      ],
      "startedAt": "2025-07-18",
      "closedAt": "2025-07-22",
      "updatedAt": "2025-07-22",
      "summary": "Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "toolshell-sharepoint-cve-2025-53770",
      "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-22",
      "title": "Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603",
      "body": "Storm-2603 deployed Warlock ransomware.",
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770"
    },
    {
      "incident": "toolshell-sharepoint-cve-2025-53770",
      "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-22",
      "title": "CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770"
    },
    {
      "incident": "toolshell-sharepoint-cve-2025-53770",
      "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-20",
      "title": "CISA adds CVE-2025-53770 to KEV and publishes guidance",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770"
    },
    {
      "incident": "toolshell-sharepoint-cve-2025-53770",
      "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-19",
      "title": "Microsoft publishes customer guidance for CVE-2025-53770",
      "body": "Apply updates, enable AMSI Full Mode, deploy Defender/EDR, rotate ASP.NET machine keys and restart IIS.",
      "sourceUrl": "https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770"
    },
    {
      "incident": "toolshell-sharepoint-cve-2025-53770",
      "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-18",
      "title": "Eye Security observes large-scale exploitation of on-prem SharePoint servers",
      "body": "Later clarified as the original ToolShell chain (CVE-2025-49706 + CVE-2025-49704).",
      "sourceUrl": "https://research.eye.security/sharepoint-under-siege/",
      "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770"
    }
  ]
}