CVE-2025-53770

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: Feb. 19, 2026 15 articles Published: 2025-07-20

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

90.21%

probability

This CVE has a 90.21% probability of being exploited in the next 30 days.

0% Top 99.6th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

9.8

CRITICAL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Functional

Remediation Level

Workaround

Report Confidence

Confirmed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C

Description

Project Zero

Deserialization of untrusted data

Affected Products

Microsoft

Microsoft SharePoint Enterprise Server 2016

16.0.0

Microsoft

Microsoft SharePoint Server 2019

16.0.0

Microsoft

Microsoft SharePoint Server Subscription Edition

16.0.0

Attack Intelligence

CWE-502 · Deserialization of Untrusted Data CWE-664 · Improper Control of a Resource Through its Lifetime CWE-913 · Improper Control of Dynamically-Managed Code Resources

Google Project Zero

Patched

July 19, 2025

Reported by

Viettel Cyber Security with Trend Zero Day Initiative

Root Cause Analysis

???

Exploits & PoC

soltanali0/CVE-2025-53770-Exploit

SharePoint WebPart Injection Exploit Tool

312

ZephrFish/CVE-2025-53770-Scanner

ToolShell scanner - CVE-2025-53770 and detection information

3a7/CVE-2025-53770

CVE-2025-53770 Mass Scanner

exfil0/CVE-2025-53770

A sophisticated, wizard-driven Python exploit tool targeting CVE-2025-53770, a critical (CVSS 9.8) unauthenticated remote code execution (RCE) vulnera

4 repos — triés par ⭐ Rechercher sur GitHub ↗

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770

vendor-advisory patch

Signal Intelligence

Confidenceⓘ

95%

EPSS 90.21%

CVSS v3.1 9.8

Mentions 15

Last Seen May 08, 2026

CNA Information

CNA Assigner

microsoft

CNA Title

Microsoft SharePoint Server Remote Code Execution Vulnerability

Analyst Note

CVE-2025-53770 is confirmed as actively exploited in the wild with a critical CVSS score of 9.8, documented exploitation by state-sponsored actors (Chinese hackers), and reported attacks against high-value targets including US nuclear weapons facilities. The vulnerability involves remote code execution through unsafe deserialization in SharePoint on-premises, with multiple credible news sources corroborating active exploitation and Microsoft acknowledging the threat.