SharePoint Server RCE via deserialization actively exploited
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA confirms active exploitation of critical unauthenticated remote code execution vulnerabilities in Microsoft SharePoint Server.
Multiple critical vulnerabilities in Microsoft SharePoint Server enable unauthenticated remote code execution through deserialization of untrusted data and path traversal attacks. CVE-2025-53770 (deserialization flaw) and CVE-2025-53771 (path traversal) are actively being exploited in the wild under the designation "ToolShell," granting attackers full access to SharePoint content, file systems, internal configurations, and code execution capabilities over the network without authentication.
These vulnerabilities affect SharePoint Server Subscription Edition (prior to KB5002768), SharePoint Server 2019 Core (prior to KB5002754), SharePoint Server 2019 Language Pack (prior to KB5002753), SharePoint Enterprise Server 2016 (prior to KB5002760), and SharePoint Enterprise Server 2016 Language Pack (prior to KB5002759). The flaws represent incomplete remediation of previously patched vulnerabilities (CVE-2025-49704 and CVE-2025-49706), with attackers using advanced deserialization techniques and ViewState abuse to bypass earlier fixes.
Microsoft released patches on July 20, 2025. Organizations must apply updates immediately after testing, implement network segmentation to isolate SharePoint systems, enforce least-privilege access controls, and conduct vulnerability scanning to identify exposed instances.
Mentioned in this report
Detection guidance
SharePoint IIS Worker Process Spawning Command Shell
w3wp.exe running a SharePoint application pool spawns cmd.exe or PowerShell, consistent with post-exploitation after SharePoint deserialization RCE (ToolShell). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SharePoint IIS Worker Process Spawning Command Shell
description: Detects a w3wp.exe worker process hosting a SharePoint application pool
spawning cmd.exe or PowerShell. This is the typical post-exploitation pattern after
unauthenticated deserialization RCE in SharePoint (CVE-2025-53770 / ToolShell).
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: SharePoint
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
condition: selection
falsepositives:
- Custom SharePoint farm solutions or web parts that deliberately shell out to cmd
or PowerShell
level: high
id: e820b79b-d4a7-58eb-a86e-7930ec9c6069
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-sharepoint-server-could-allow-for-remote-code-execution_2025-066---updated-was-emailed-as-2025-065-in-email-notification-should-have-been-2025-066
ASPX Web Shell Written to SharePoint LAYOUTS Directory by Worker or Shell Process
An .aspx file is created in the SharePoint TEMPLATE\LAYOUTS folder by w3wp, PowerShell or cmd, as seen when ToolShell drops a web shell to steal machine keys. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ASPX Web Shell Written to SharePoint LAYOUTS Directory by Worker or Shell Process
description: Detects creation of .aspx files under the SharePoint TEMPLATE\LAYOUTS
directory by w3wp.exe, PowerShell or cmd.exe. Post-exploitation of CVE-2025-53770
drops a web shell here to extract ASP.NET machine keys. Matches on the location
and creating process, not a specific filename.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \w3wp.exe
- \powershell.exe
- \pwsh.exe
- \cmd.exe
TargetFilename|contains|all:
- \web server extensions\
- \TEMPLATE\LAYOUTS\
TargetFilename|endswith: .aspx
condition: selection
falsepositives:
- Administrators deploying custom layout pages with PowerShell scripts during SharePoint
solution deployment
level: high
id: 4dab0b95-0266-5b75-9e83-5cb9fb35cc09
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-sharepoint-server-could-allow-for-remote-code-execution_2025-066---updated-was-emailed-as-2025-065-in-email-notification-should-have-been-2025-066
SharePoint ToolPane.aspx Exploitation Attempt with SignOut Referer
POST requests to ToolPane.aspx with DisplayMode=Edit and a SignOut.aspx referer, the request pattern used to exploit SharePoint ToolShell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SharePoint ToolPane.aspx Exploitation Attempt with SignOut Referer
description: Detects POST requests to /_layouts/15/ToolPane.aspx with DisplayMode=Edit
and a SignOut.aspx referer in web server logs. This is the request pattern used
to deliver the deserialization payload in the ToolShell exploitation of CVE-2025-53770
/ CVE-2025-53771.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|endswith: /ToolPane.aspx
cs-uri-query|contains: DisplayMode=Edit
cs-referer|contains: SignOut.aspx
condition: selection
falsepositives:
- Vulnerability scanners or red team exercises replaying the public ToolShell exploit
against SharePoint
level: high
id: 06b54eaf-37a6-577b-a779-b7a83721c8eb
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-sharepoint-server-could-allow-for-remote-code-execution_2025-066---updated-was-emailed-as-2025-065-in-email-notification-should-have-been-2025-066
Behavioural rules are generated from public reporting — validate in your environment before deploying.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs