https://pwn.watch/t/toolshell Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 22 Jul 2025 00:00:00 GMT https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 Tue, 22 Jul 2025 00:00:00 GMT critical <p>Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See Microsoft customer guidance for CVE-2025-53770</p> <p><strong>Latest updates:</strong></p><ul><li>2025-07-22: Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603 (<a href="https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/">source</a>)</li><li>2025-07-22: CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV</li><li>2025-07-20: CISA adds CVE-2025-53770 to KEV and publishes guidance (<a href="https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2025-49704, CVE-2025-49706, CVE-2025-53770</p>