CVE-2025-53770: Microsoft SharePoint Server deserialization RCE under active exploitation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE in internet-facing SharePoint with confirmed in-the-wild exploitation, KEV listing, near-certain EPSS score and known ransomware use.

What it is

On-premises Microsoft SharePoint Server deserializes untrusted data, letting an unauthenticated network attacker run code on the server. Microsoft states an exploit exists in the wild and that a comprehensive update is still in preparation, so defenders must rely on mitigations in the interim. The flaw is critical because it is remotely reachable without credentials and is already being exploited at scale.

Impact

An attacker gains remote code execution on the SharePoint server, which typically means full control of the host and access to connected content, credentials and downstream systems. CISA's KEV entry notes known ransomware campaign use, so follow-on encryption or extortion is a realistic outcome.

Attack surface

Reached over the network against internet-facing on-premises SharePoint Server; the CVSS vector shows no privileges and no user interaction required. No specific endpoint or component is named in the record, so the exact entry point is not stated.

Exploitation

Active exploitation is confirmed: CISA added it to KEV on 2025-07-20 with a 2025-07-21 due date and known ransomware use, EPSS 30-day probability is 0.99998, and multiple references carry Exploit tags.

What to do

• Apply the Microsoft update as soon as it is released; until then follow the MSRC customer guidance and CISA alert mitigations exactly.
• Disconnect or isolate internet-facing SharePoint Server instances that are end-of-life or end-of-service, including SharePoint Server 2013 and earlier, per CISA's required action.
• Restrict or block external access to SharePoint until mitigations are in place, and apply the applicable BOD 22-01 guidance or discontinue use if mitigations are unavailable.
• Rotate SharePoint machine keys and any credentials or secrets that may have been exposed on affected servers.
• Review SharePoint servers for signs of prior compromise before restoring normal exposure.

Detection

• Hunt web server and SharePoint logs for anomalous POST requests or deserialization-related activity from unexpected external sources.
• Monitor for unexpected child processes spawned by SharePoint worker processes (w3wp.exe), a common post-exploitation signal for web shells.
• Scan the SharePoint web root and layout directories for newly written or modified files such as web shells.
• Alert on outbound connections from SharePoint servers to unfamiliar hosts, which may indicate command-and-control or data staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.