ToolShell: patch on-premises SharePoint for CVE-2025-53770
In July 2025 attackers chained SharePoint Server bugs, publicly called ToolShell, to run code without a login. SharePoint Online was not the affected product. The machine keys were.
CISA's alert of 20 July 2025, updated through 6 August, describes active use of a chain against on-premises Microsoft SharePoint Server. CVE-2025-53770 is the deserialization bug in that chain, a bypass of the earlier fix for CVE-2025-49704. Microsoft scored it 9.8. CVE-2025-53771 is the related authentication bypass, a bypass of CVE-2025-49706.
CISA added CVE-2025-53770 to the exploited catalog on 20 July 2025. The alert later noted file encryption and Warlock ransomware on compromised servers. SharePoint Online and Microsoft 365 are not the vulnerable product.
What was affected
SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Server 2016. End-of-life releases, including SharePoint Server 2013 and earlier, had no fix to apply. CISA's required action for those is to disconnect them from the internet.
The chain gave unauthenticated access to content and the ability to run code on the server. Public reporting, including CISA's August malware analysis, describes web shells left on compromised hosts. This note does not describe the request that got them there.
Why a patch alone did not end it
Microsoft and the responders said attackers stole the server's ASP.NET machine keys. Those keys let a later request be trusted after the vulnerable page is gone. A host that installed the July update and kept the old keys could still be re-entered.
That is why the remediation lists two steps: the update, and rotating the keys. Rotating keys signs out people and breaks some integrations on purpose. Plan it. Skipping it leaves the credential the intrusion already copied.
Which update to install
Use the emergency updates Microsoft published for Subscription Edition, 2019 and 2016 in the 20–21 July 2025 window, and any later cumulative update that supersedes them. The vendor's CVE page is the list that stays current. A July Patch Tuesday install from before the bypass is the build this incident went around.
If the server is 2013 or older, there is no build to wait for. Take it off the internet, as CISA wrote in the catalog entry, and move the sites to a supported server or to SharePoint Online.
After the update
Rotate the machine keys using Microsoft's documented steps for SharePoint, then restart the farm so every server drops the old material. Search the server for unexpected pages added since mid-July 2025 and preserve them if you find any. Assume accounts and service passwords that the SharePoint process could read need a reset.
Send IIS and SharePoint logs to a store the server cannot edit. The August CISA malware report is the place for indicators. Detection rules are not a substitute for the update and the key rotation.
CISA's SharePoint alert, first published 20 July 2025 and updated through 6 August 2025.
https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities
Frequently asked questions
Does SharePoint Online need CVE-2025-53770?
No. Microsoft and CISA limited the bug to on-premises SharePoint Server. SharePoint Online was not the affected product. An old server you still publish next to the tenant was.
Is installing the July update enough?
Install the emergency update for your supported edition and rotate the ASP.NET machine keys. Microsoft said stolen keys survived the code fix. End-of-life servers should be disconnected.
Which CVE goes on the change ticket?
CVE-2025-53770 is the one CISA listed on 20 July 2025. Name CVE-2025-53771 next to it, and the earlier pair CVE-2025-49704 and CVE-2025-49706, because the July fixes bypassed those patches.