CVE-2025-53770

Microsoft SharePoint: Deserialization of Untrusted Data

As of , CVE-2025-53770 in Microsoft SharePoint is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 20 July 2025
US federal deadline
21 July 20251 day after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
KnownCISA changed it from Unknown to Known on 5 August 2025.
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
Public exploit
1 Metasploit module and 1 Exploit-DB entry
Fix
Vendor advice: msrc.microsoft.com and www.microsoft.comLinks below, from CISA's entry.

What CISA says to do

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

CISA's required action

What the flaw is

Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

CISA's description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

The CVE record's description, from microsoft

CVE published
20 July 2025
Assigned by
microsoft
CVSS
9.8 Critical (CVSS 3.1, from the CNA)
CWE-502
Deserialization of Untrusted Data
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Edited: notes.
  5. CISA changed its entry. Ransomware use: Unknown to Known. Edited: required action and description.
  6. Exploit-DB published an exploit (EDB-ID 52405).

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

SharePoint: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2026-55040Weak AuthenticationMicrosoft SharePointPatch nowForensic triage required by CISA0.70
CVE-2026-58644Deserialization of Untrusted DataMicrosoft SharePointPatch nowForensic triage required by CISA0.16
CVE-2026-50522Deserialization of Untrusted DataMicrosoft SharePointPatch nowForensic triage required by CISA0.03
CVE-2026-65660Code InjectionMicrosoft SharePointPatch nowForensic triage required by CISA; listed in the last 14 days0.02
CVE-2025-49704Code InjectionMicrosoft SharePointPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
CVE-2025-49706Improper AuthenticationMicrosoft SharePointPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
CVE-2019-0604Remote Code ExecutionMicrosoft SharePointPatch this weekRansomware use; EPSS 0.990.99
CVE-2024-38094DeserializationMicrosoft SharePointPatch this weekRansomware use; EPSS 0.510.51
CVE-2026-20963Deserialization of Untrusted DataMicrosoft SharePointPatch soon0.30

Read further