CVE-2025-53771: Microsoft SharePoint Server improper authentication allows spoofing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityNetwork-reachable, no authentication or interaction required, and an extremely high EPSS score with press reporting of zero-day exploitation, though the record lacks a patch confirmation and full technical detail.

What it is

CVE-2025-53771 is an improper authentication flaw (CWE-287) in Microsoft SharePoint Server that lets an unauthorized attacker perform spoofing over a network. The record gives no affected version list and only a one-line description, so the exact spoofing mechanism is not documented here. It matters because the flaw is network-reachable with no privileges or user interaction required, and press coverage referenced in the record describes it as a SharePoint zero-day exploited in RCE attacks with no patch available at the time.

Impact

An attacker can impersonate a legitimate user or service and gain low-level confidentiality and integrity impact without any credentials. The record does not detail what data or actions the spoofing enables beyond that.

Attack surface

Reached over the network via the SharePoint web interface, per the CVSS vector AV:N/PR:N/UI:N, so no authentication and no user interaction are needed. The description does not identify the specific endpoint or request pattern involved.

Exploitation

Not listed in CISA KEV, but EPSS is 0.99735 (99.95th percentile), indicating very high predicted exploitation activity. A referenced press article states the flaw was exploited in RCE attacks as a zero-day with no patch available at publication, though the record itself does not confirm in-the-wild exploitation.

What to do

• Apply the Microsoft SharePoint Server security update from the MSRC advisory as soon as it is available; treat this as the primary fix.
• If no patch is available for your build, restrict network access to SharePoint servers to trusted networks and required users only.
• Enable and review SharePoint unified audit logging and sign-in logs for anomalous or spoofed identities.
• Monitor Microsoft and CISA guidance for updated patch status and interim mitigations, since the record notes no patch at publication.
• Reduce exposure by placing SharePoint behind authenticated reverse proxies or VPN where operationally feasible.

Detection

• Hunt SharePoint and IIS logs for requests to authentication or identity endpoints from unexpected source IPs or user agents.
• Correlate SharePoint audit events with identity provider sign-in logs to find sessions or actions attributed to users who did not authenticate.
• Alert on authentication failures followed by successful privileged actions or token reuse patterns on SharePoint servers.
• Baseline normal SharePoint request paths and alert on deviations consistent with spoofing or exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.