{"id":351371,"date":"2025-07-20T19:17:59","date_gmt":"2025-07-21T02:17:59","guid":{"rendered":"https:\/\/msftnewsnow.com\/?p=351371"},"modified":"2025-07-20T19:18:37","modified_gmt":"2025-07-21T02:18:37","slug":"microsoft-sharepoint-zero-day-attack-toolshell","status":"publish","type":"post","link":"https:\/\/msftnewsnow.com\/microsoft-sharepoint-zero-day-attack-toolshell\/","title":{"rendered":"Critical Microsoft SharePoint Zero-Day Attack CVE-2025-53770 Exposes On-Premises Servers, Emergency Guidance Issued"},"content":{"rendered":"
\n
\n

Microsoft has confirmed a major zero-day vulnerability is being actively exploited in on-premises SharePoint Server, with no patch currently available for most affected versions. Dubbed CVE-2025-53770<\/a>\u2014nicknamed \u201cToolShell\u201d by researchers\u2014the Microsoft SharePoint flaw enables unauthenticated attackers to take full control of targeted SharePoint servers. As of July 20, 2025, the attacks have hit at least 75 to 85 organizations globally (via Forbes<\/em><\/a>), ranging from government agencies and financial institutions to universities and the energy sector.<\/p>\n

Microsoft urges urgent mitigation as attackers escalate exploitation, leveraging the vulnerability to plant persistent backdoors and steal sensitive cryptographic keys. Here\u2019s everything you need to know to assess your risk, respond to the evolving threat, and secure your infrastructure.<\/p>\n

What Is the SharePoint ToolShell Zero-Day (CVE-2025-53770)?<\/strong><\/h2>\n

\"Critical<\/a><\/p>\n

The flaw stems from insecure deserialization<\/strong> within SharePoint\u2019s server logic. This allows attackers to craft malicious HTTP POST requests to specific SharePoint endpoints, resulting in unauthorized code execution on the server\u2014even without valid credentials<\/em>.<\/p>\n

Once exploited, hackers can:<\/p>\n