CVE-2025-53770: Insecure Deserialization RCE in Microsoft SharePoint Server (ToolShell)

HERMES

HERMES THREAT SCORE & ENTERPRISE COLLABORATION EXPOSURE

Target: Microsoft SharePoint Enterprise Server 2016 / 2019 / Subscription Edition

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2025-53770 at a maximum HTS of 98 (CRITICAL). This pre-auth .NET deserialization flaw enables unauthenticated remote code execution without user interaction. Widely exploited as an in-the-wild zero-day, it enables webshell implantation, LSASS credential dumping, and automated enterprise-wide Warlock ransomware distribution via Active Directory GPOs.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-53770: Insecure Deserialization RCE in Microsoft SharePoint Server (ToolShell)VULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Identification

Parameter	Technical Specification	Operational Impact
CVE Identifier	`CVE-2025-53770`	Official NVD / MITRE record
Associated CWE	`CWE-502`: Deserialization of Untrusted Data	Unsanitized .NET object deserialization
CVSS v3.1 Score	9.8 CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS v4.0 Score	9.5 CRITICAL	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
Applicable CPEs	`cpe:2.3:a:microsoft:sharepoint_server_2016::::::::` `cpe:2.3:a:microsoft:sharepoint_server_2019::::::::` `cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::*`	On-premises enterprise collaboration farms
Affected Versions	2016 (`< 16.0.5513.1001`), 2019 (`< 16.0.10417.20037`), SE (`< 16.0.18526.20508`)	All unpatched on-premises SharePoint deployments
Fixed Versions	16.0.5513.1001 (KB5002741), 16.0.10417.20037 (KB5002740), 16.0.18526.20508 (KB5002742)	Out-of-band emergency security updates July 2025

2. Exploitation

CISA KEV: Added on July 20, 2025; confirmed active ransomware campaign utilization (KnownRansomwareCampaignUse = Known).
EPSS Score: 0.99998 (Percentile: 99.998% — among the highest threat weaponization percentiles recorded).
Operational Status: Mass in-the-wild exploitation globally. Zero-day leveraged prior to vendor advisory and security update availability.
PoC & Weaponization: Public exploit toolkits and automated scanning suites available (e.g., soltanali0/CVE-2025-53770-Exploit, ToolShell suites).
Access Conditions: Pre-authentication (zero credentials required); network accessible (ports 80, 443, or central admin ports); low attack complexity.

3. Threat Intelligence

Active Threat Actors:
- Linen Typhoon (China-nexus, cyber espionage targeting government and defense).
- Violet Typhoon (China-nexus, intellectual property theft across strategic research targets).
- Storm-2603 (Financially motivated threat group operating double-extortion schemes).
Associated Ransomware: Warlock ransomware, distributed at scale post-compromise.
Implants & Malwares: Webshells masquerading as legitimate maintenance files: spinstall0.aspx, spinstall.aspx, spupdate.aspx, SpLogoutLayout.aspx, SP.UI.TitleView.aspx.
Exploitation Timeline:
- July 7, 2025: Earliest probing and stealthy exploitation attempts detected by Microsoft Threat Intelligence.
- July 19, 2025: Global mass exploitation and weaponized scanning surge detected (Eye Security / Shadowserver).
- July 20, 2025: CISA publishes emergency alert and adds CVE-2025-53770 to the KEV catalog.
- July 20-22, 2025: Microsoft releases comprehensive out-of-band security updates.

4. Detection and Forensics

Indicators of Compromise (IOCs)

Attacker IP Addresses: 131.226.2.6, 134.199.202.205, 104.238.159.149, 188.130.206.168, 65.38.121.198
C2 Domains: c34718cbb4c6.ngrok-free.app
SHA-256 Hashes:
- 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514
- 24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b903313768c6

Sigma Rule

title: Microsoft SharePoint ToolShell Exploitation Attempt (CVE-2025-53770)
id: 53770-sharepoint-toolshell-en
status: production
description: Detects suspicious HTTP POST requests directed at ToolPane.aspx with WebPart injection parameters.
logsource:
  category: webserver
  product: iis
detection:
  selection_url:
    cs-method: 'POST'
    cs-uri-stem|contains: '/_layouts/15/ToolPane.aspx'
  selection_param:
    cs-uri-query|contains: 'MSOTlPn_SelectedWpId'
  condition: selection_url and selection_param
fields:
  - c-ip
  - cs-username
  - cs-method
  - cs-uri-stem
  - sc-status
falsepositives:
  - Rare legitimate WebPart configuration operations (verify originating source IP and user authentication).
level: critical

YARA Rule

rule Exploit_SharePoint_ToolShell_Webshell {
    meta:
        description = "Detects ToolShell spinstall0.aspx webshells deployed via CVE-2025-53770"
        author = "Hermes Codex Research"
        date = "2026-09-10"
        reference = "CVE-2025-53770"
    strings:
        $s1 = "Page Language="C#"" ascii
        $s2 = "ProcessStartInfo" ascii
        $s3 = "RedirectStandardOutput = true" ascii
        $s4 = "MSOTlPn_SelectedWpId" ascii
        $magic = "<%@" ascii
    condition:
        $magic at 0 and ($s1 and ($s2 or $s3) and filesize < 50KB) or $s4
}

Suricata / Snort Rule

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"HERMES - SharePoint ToolPane Deserialization Attempt (CVE-2025-53770)"; flow:to_server,established; content:"POST"; http_method; content:"/ToolPane.aspx"; http_uri; content:"MSOTlPn_SelectedWpId"; http_client_body; classtype:web-application-attack; sid:202553770; rev:1;)

Forensic Artifacts & Logs

IIS W3C Logs: Audit HTTP POST requests returning 200 OK on /_layouts/15/ToolPane.aspx.
Sysmon / Event ID 4688: Parent process w3wp.exe spawning cmd.exe, powershell.exe, or certutil.exe.
File System: Inspect C:\Program Files\Common Files\microsoft shared\Web Server Extensions \TEMPLATE\LAYOUTS\ and 16\... for newly created .aspx files.
MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1059.001 (PowerShell), T1003.001 (LSASS Memory Dump), T1486 (Data Encrypted for Impact).

5. Remediation and Hardening

Apply Emergency Updates: Immediately install KB5002740 (SharePoint 2019), KB5002741 (SharePoint 2016), or KB5002742 (Subscription Edition).
Server Reboot Required: A full operating system reboot of each farm server is required to flush the Global Assembly Cache (GAC) and reload IIS application pools.
Temporary Mitigation: If immediate patching is prevented by maintenance windows, restrict external access to ToolPane.aspx at the perimeter WAF, and enable Antimalware Scan Interface (AMSI) via PowerShell: Set-SPAntimalwareScan -Enabled $true.
Secret & Key Rotation: If exploitation is suspected, immediately cycle IIS machine keys (MachineKey), rotate all SharePoint farm service account credentials, and issue new Security Token Service (STS) signing certificates.
Post-Breach Triage: Inspect TEMPLATE\LAYOUTS for unauthorized scripts, review newly created scheduled tasks, and audit Active Directory Group Policy Objects (GPO) for unexpected modifications.

6. Enterprise Exploitation Scenario

« What happens if this vulnerability is exploited in an enterprise? »
Section titled “« What happens if this vulnerability is exploited in an enterprise? »”

Initial Perimeter Breach: Without requiring any credentials, an external adversary sends a crafted HTTP POST request to an internet-exposed SharePoint portal. The ToolPane.aspx handler deserializes an attacker-controlled GZIP-compressed .NET object, instantly executing code within the IIS worker process context (w3wp.exe).

Persistence Establishment: The attacker drops the covert webshell spinstall0.aspx into the SharePoint layouts directory. This webshell serves as an interactive backdoor granting reliable command-and-control access.

Credential Harvesting: The adversary dumps lsass.exe memory using Mimikatz, extracting plaintext credentials and Kerberos tickets for high-privilege administrators logged into the SharePoint server.

Lateral Movement: Leveraging harvested credentials, the attacker pivots across internal subnets using PsExec and Impacket, quickly compromising Active Directory Domain Controllers.

Warlock Ransomware Execution: The threat actor modifies Active Directory Group Policy Objects (GPOs) to force-distribute and execute Warlock ransomware across all domain-joined endpoints and file repositories. Business operations halt completely, critical intellectual property is exfiltrated, and the enterprise faces extortion demands in the millions of dollars.