CVE-2025-53770
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
- Affected products
- Sharepoint Server
- Microsoft Sharepoint Server
- < 16.0.18526.20508, 2016, 2019
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 100.0% (100th percentile)
- Weakness
- CWE-502
- NVD status
- Analyzed
- Published
- 2025-07-20
CVE-2025-53770 at NVD
41 known exploits for CVE-2025-53770
Proof-of-concept code and exploit modules indexed by Sploitus
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
📄 Microsoft SharePoint Server ToolPane Authentication Bypass / Unsafe Deserialization
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
📄 Microsoft SharePoint Server 2019 16.0.10383.20020 Remote Code Execution
Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
Exploit for Deserialization of Untrusted Data in Microsoft
Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
📄 Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
📄 SharePoint Remote Code Execution
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft
Exploit for Deserialization of Untrusted Data in Microsoft