CVE-2025-53770 - Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Project:Microsoft
Product:SharePoint
Date Added:2025-07-20Due Date:2025-07-21
Vulnerability Name
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Description
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network.
Known To Be Used in Ransomware Campaigns?
Unknown
Action
CISA recommends configuring AMSI integration in SharePoint and deploying Defender AV on all SharePoint servers. If AMSI cannot be enabled, CISA recommends disconnecting affected products that are public-facing on the internet from service until official mitigations are available. Once mitigations are provided, apply them according to CISA and vendor instructions. Follow the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Additional Notes
CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
https://nvd.nist.gov/vuln/detail/CVE-2025-53770
Related News Articles
Microsoft: SharePoint flaws exploited in Warlock ransomware attacksJuly 24, 2025
Microsoft links Sharepoint ToolShell attacks to Chinese hackersJuly 22, 2025
Microsoft pins on-prem SharePoint attacks on Chinese threat actorsJuly 22, 2025
Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacksJuly 21, 2025
Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber AttacksJuly 21, 2025