Microsoft · Microsoft SharePoint Enterprise Server 2016
An improper authentication flaw in the Microsoft Office SharePoint component of Microsoft SharePoint Enterprise Server 2016 allows spoofing. An unauthorized attacker with network access can exploit it without authentication or user interaction to perform spoofing.
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
First seen exploited 2 days before it was disclosed. Public exploit code (Metasploit) was available 12 days before disclosure.
authentication flaw enables unauthorized access
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker
unauthenticated network attack on public-facing SharePoint
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2025-53771 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
About 24 hours after we published our initial findings and contacted affected vendors, the Microsoft Security Response Center (MSRC) released an out-of-band advisory addressing two new CVEs: CVE-2025-53770 (a patch bypass of CVE-2025-49704) and CVE-2025-53771 (a bypass of CVE-2025-49706).
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.