A critical security vulnerability in Microsoft SharePoint Server has been exploited in an active and large-scale campaign, putting users at risk. The flaw, known as CVE-2025-53770, has a high CVSS score of 9.8 and is a variant of a previous bug, CVE-2025-49706. Microsoft has acknowledged the issue and is working on a comprehensive update to address it, with credit given to Viettel Cyber Security for discovering the flaw.
Active attacks targeting on-premises SharePoint Server customers have been reported, prompting Microsoft to issue alerts for users to take precautionary measures. While SharePoint Online in Microsoft 365 remains unaffected, customers are advised to configure Antimalware Scan Interface (AMSI) integration and deploy Defender AV on all SharePoint servers for added protection.
Eye Security and Palo Alto Networks Unit 42 have warned of attacks chaining multiple vulnerabilities in SharePoint, including CVE-2025-53770, CVE-2025-49706, and CVE-2025-49704. These exploits, collectively known as ToolShell, involve delivering ASPX payloads via PowerShell to steal crucial server configurations and enable remote code execution opportunities.
The impact of these attacks is significant, with adversaries gaining access to sensitive data and potentially compromising a large number of organizations worldwide. Microsoft has yet to update its advisories for the vulnerabilities being exploited, and further details are awaited from the company. The situation is evolving rapidly, and users are advised to stay updated on developments regarding these security concerns.
Source link
