{"id":"CVE-2025-53771","published":"2025-07-20T22:16:52Z","modified":"2026-02-13T19:07:03Z","title":"Microsoft SharePoint Server Spoofing Vulnerability","vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","versions":[">= 16.0.0, < 16.0.5513.1001"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server 2019","versions":[">= 16.0.0, < 16.0.10417.20037"]},{"vendor":"Microsoft","product":"Microsoft SharePoint Server Subscription Edition","versions":[">= 16.0.0, < 16.0.18526.20508"]}],"description":{"text":"Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.","provenance":"source","from":"CVE.org"},"summary":{"text":"An improper authentication flaw in the Microsoft Office SharePoint component of Microsoft SharePoint Enterprise Server 2016 allows spoofing. An unauthorized attacker with network access can exploit it without authentication or user interaction to perform spoofing.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:39Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.9989,"percentile":0.99965,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-07-18","exploitedFirstSeen":"2025-07-18","ransomware":true,"evidence":[{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-18"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities","date":"2025-07-21"},{"url":"https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/","date":"2025-07-21"},{"url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/","date":"2025-07-21"},{"url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-blocks-sharepoint-zero-day-exploitation/","date":"2025-07-21"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-21"},{"url":"https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k","date":"2025-07-21"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day","date":"2025-07-22"},{"url":"https://www.bitsight.com/blog/toolshell-threat-brief-sharepoint-rce-vulnerabilities-cve-2025-53770-53771-explained","date":"2025-07-22"},{"url":"https://www.logpoint.com/en/blog/toolshell-when-sharepoint-becomes-a-gateway-to-rce/","date":"2025-07-22"}],"evidenceTotal":65,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure","url":"https://otx.alienvault.com/pulse/6ad1a6eb3af1f746d2dbb6fe","created":"2026-10-16"},{"name":"ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure","url":"https://otx.alienvault.com/pulse/6acf7922d9bc17d95d27ec5c","created":"2026-10-14"},{"name":"DragonForce • Warlock + Catbox • Remote Attack Compilation - Quick Check","url":"https://otx.alienvault.com/pulse/6ac6d1215522808876280b52","created":"2026-10-07"},{"name":"Warlock Infrastructure - ATA as Gold Salem, Longlegs,  and Storm-260,3  previously exploited by DragonForce","url":"https://otx.alienvault.com/pulse/6ac65a6561f86416c31b8323","created":"2026-10-07"},{"name":"Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer","url":"https://otx.alienvault.com/pulse/6ac5dad9336ba666461a2df6","created":"2026-10-07"},{"name":"Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer","url":"https://otx.alienvault.com/pulse/6ac4b1c8431cd87d87aa1784","created":"2026-10-06"},{"name":"[ShadowBrieferFeed] Warlock Ransomware Attackers Hit Water and Telecom Operators | SECURITY.COM","url":"https://otx.alienvault.com/pulse/6ac3fd3d4086b4dd5ef50c80","created":"2026-10-05"},{"name":"Warlock Ransomware Attackers Hit Water and Telecom Operators","url":"https://otx.alienvault.com/pulse/6ac338a9cf325c4919d1b050","created":"2026-10-05"},{"name":"Warlock Ransomware Attackers Hit Water and Telecom Operators","url":"https://otx.alienvault.com/pulse/6abe7e463c092196777a7816","created":"2026-10-01"},{"name":"Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators","url":"https://otx.alienvault.com/pulse/6abe755efaf42cd416fc6d3f","created":"2026-10-01"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771","tags":["vendor-advisory","patch"]},{"url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/","tags":[]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated network attack on public-facing SharePoint","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker","start":0,"end":86}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: authentication flaw enables unauthorized access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker","start":0,"end":86}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-e7dfbcdaedcbed88ea81","title":"SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Research SharePoint 0-day uncovered (CVE-2025-53770)","publisher":"research.eye.security","url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-19","mentions":[{"quote":"Patch Clarifications: CVE-2025-53770 and CVE-2025-53771","start":16824,"end":16879},{"quote":"About 24 hours after we published our initial findings and contacted affected vendors, the Microsoft Security Response Center (MSRC) released an out-of-band advisory addressing two new CVEs: CVE-2025-53770 (a patch bypass of CVE-2025-49704) and CVE-2025-53771 (a bypass of CVE-2025-49706).","start":16883,"end":17172}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-22040","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22040","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)","module":"exploit/windows/http/sharepoint_toolpane_rce","type":"exploit","disclosureDate":"2025-07-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"}],"nuclei":[{"id":"CVE-2025-53771","name":"Microsoft SharePoint Server - Authentication Bypass (ToolShell)","severity":"medium","path":"http/cves/2025/CVE-2025-53771.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53771.yaml"}],"first":{"date":"2025-07-08","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2025-07-08","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb","provenance":"source"},{"date":"2025-07-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://research.eye.security/sharepoint-under-siege/","provenance":"source"},{"date":"2025-07-19","kind":"report","label":"Named in research.eye.security: SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Resea…","url":"https://research.eye.security/sharepoint-under-siege/","provenance":"machine"},{"date":"2025-07-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-53771","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":81.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 469 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}