CVE-2025-53770: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CVSS: 9.8v3.1CriticalKEVRansomwareAnalyzed

Published 20-07-2025Last modified 04-08-2026

Vulnerability summary

CVE-2025-53770 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in Microsoft SharePoint. It is known to be exploited: CISA, ENISA and CIRCL list it, first on 20-07-2025. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

100.00%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA · ENISA · CIRCL

RansomwareKnown useFlagged by CISA

Public exploits5github, reference, exploit-database, metasploit

Timeline

20-07-2025
PublishedVulnerability first disclosed.
20-07-2025
Added to CISA KEVMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability
20-07-2025
Added to CIRCL KEVAdded to the CIRCL known exploited vulnerabilities catalog.
21-07-2025
CISA remediation dueApply mitigations per vendor instructions.
08-04-2026
Added to ENISA KEVAdded to the ENISA known exploited vulnerabilities catalog.
04-08-2026
Last modifiedVulnerability information updated.

Description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.8

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 100.00% on 21-09-2026

21-09-202621-10-2026

EPSS score

100.00%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 20-07-2025
Federal due date: 21-07-2025

ENISA CNWListed

Added: 08-04-2026

CIRCLListed

Added: 20-07-2025

CISA required action

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. www.microsoft.com/en-us/… msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 nvd.nist.gov/vuln/detail/CVE-2025-53770

Public exploits

5 found

githubUnverified
Cve 2025 53770
Maturity: poc
referenceUnverified
Exploit Reference (research.eye.security)
Maturity: unknown
referenceUnverified
Exploit Reference (arstechnica.com)
Maturity: unknown

Show all 5 exploits

exploit-databaseremotewindowsUnverified
Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
Maturity: poc
MetasploitremoteVerified
Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
exploit/windows/http/sharepoint_toolpane_rce
Maturity: weaponized