What breaks and who should care
If you run Microsoft SharePoint Server on‑premises, this alert is for you. CVE-2025-53770 is a critical flaw that lets an unauthorised attacker execute code on your server over the network. The vulnerability is already being used in ransomware attacks. If your organisation exposes SharePoint to the internet, or even if it sits behind a VPN that could be reached by a compromised host, you are in the line of fire.
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
How the flaw works
The NVD describes this issue as a deserialization of untrusted data vulnerability. In plain English, SharePoint accepts data that it later turns back into an object. An attacker can craft that data so that, when SharePoint deserialises it, the attacker‑controlled code runs with the same privileges as the SharePoint service account. Because the service runs with high privileges, the attacker can take full control of the host.
The exact details of the malicious payload are not public. Microsoft has confirmed that the flaw resides in the way SharePoint processes certain web‑service calls. The vulnerability can be chained with another flaw that allows an attacker to bypass authentication, giving a clear path from a remote request to code execution.
What makes this especially nasty is that the vulnerability is a patch bypass for an earlier issue. The updates released for CVE-2025-53770 contain additional checks that the earlier fix missed, meaning that simply applying the older patch does not protect you.
How bad is it really?
CVSS rates it at 9.8 – that is the highest band of severity. The score reflects the ease of remote exploitation, the lack of required user interaction, and the high impact on confidentiality, integrity and availability. CISA has listed it in the Known Exploited Vulnerabilities catalogue on the day it was published, and they have observed ransomware groups actively using it.
In practice this means an attacker who discovers a vulnerable SharePoint instance can drop a payload, encrypt data, and demand a ransom, all without needing a foothold inside your network. The impact is therefore comparable to the most damaging ransomware incidents you have seen.
Are you affected?
First, check whether you are running a SharePoint Server version that is listed as vulnerable. The table below, generated automatically from the National Vulnerability Database, shows which builds are vulnerable and which contain the fix. If your build appears in the vulnerable column, you are at risk.
To see the exact build your farm is running, use one of the following methods:
- Open Central Administration, navigate to System Settings → Manage servers in this farm. The version column shows the build identifier.
- Run PowerShell on any SharePoint server:
Get-SPFarm | Select-Object BuildVersion. The output is the build string you can compare against the table. - Check the registry key
HKLM\Software\Microsoft\Shared Tools\Web Server Extensions\15.0\WSS\Setupfor theVersionvalue.
If the build you see matches any entry in the vulnerable column, you need to act now.
Immediate mitigation steps
Do not wait for a scheduled maintenance window. The steps below will get you back to a safe state as quickly as possible.
1. Disconnect public‑facing instances
If your SharePoint Server is reachable from the internet and is past its end‑of‑life or end‑of‑service date, shut it down or block external traffic until you can patch. CISA specifically requires organisations to isolate such systems.
2. Apply the patched release
The only reliable fix is to upgrade to the patched release for your branch. Microsoft distributes the fix as a cumulative update. Follow these steps:
- Log in to the Microsoft Update Catalog (search for “SharePoint Server cumulative update”).
- Download the update that matches your SharePoint branch – the description will mention the fix for CVE-2025-53770.
- Copy the installer to every server in the farm.
- On each server, run the installer with administrative rights. The installer will stop the SharePoint timer service, apply the binaries, and restart the service automatically.
- After all servers have been updated, run the SharePoint Products Configuration Wizard to complete the upgrade.
When the wizard finishes, re‑run the PowerShell command from earlier to confirm the build now appears in the fixed column of the table.
3. Verify the patch
Once the update is applied, perform a quick sanity check:
- Open Central Administration and confirm the version column reflects the new build.
- Run
Get-SPFarm | Select-Object BuildVersionagain – it should now show a build listed as fixed. - Check the Windows Event Log for any errors related to SharePoint services during the restart.
If a patch is unavailable or you cannot patch immediately
Sometimes you may be locked out of a maintenance window, or the cumulative update may not yet be available for a very old branch. In those cases, mitigate the risk with defence‑in‑depth measures.
Network isolation
Block inbound traffic to the SharePoint web front‑end ports (usually 80 and 443) from any source that is not part of your internal network. Use a firewall rule that only allows traffic from known corporate subnets.
Application‑level hardening
Disable the web‑service endpoints that are not required for your business processes. In Central Administration, go to Manage web applications, select the web application, then under General Settings turn off unnecessary service calls.
Monitoring and detection
Deploy a web‑application firewall (WAF) that can detect abnormal request patterns. Look for unusually large POST bodies or requests that contain serialized objects. Enable SharePoint’s audit logging and forward the logs to a SIEM for real‑time alerts.
Account hygiene
Ensure the SharePoint service account follows the principle of least privilege. It should not be a domain admin and should have no rights to modify critical system files. If an attacker gains code execution, a tightly scoped account will limit the damage.
What to do after you patch
Patch, then audit. Run a full vulnerability scan again to confirm CVE-2025-53770 no longer appears. Review your backup strategy – ransomware often targets backups as well. Verify that you have immutable, off‑site copies of critical SharePoint data.
Finally, document the incident response. Note the time you discovered the vulnerability, the steps you took to remediate, and any lessons learned. This will speed up future responses and satisfy audit requirements.
Summary
CVE-2025-53770 is a critical remote code execution flaw in on‑premises SharePoint Server. It is being actively exploited in ransomware campaigns. Check your build against the table below, apply the cumulative update that contains the fix, and isolate any public‑facing instances that cannot be patched immediately. Follow the mitigation checklist, verify the patch, and tighten your overall security posture. The clock is ticking – act now.
Affected versions
Straight from the NVD record for CVE-2025-53770. If your build is inside one of these ranges, treat it as vulnerable.
| Product | Affected range | Fixed in |
|---|---|---|
sharepoint_server |
* up to 16.0.18526.20508 | 16.0.18526.20508 |
