# SharePoint Server RCE via deserialization actively exploited

Published: 2026-06-09 · Severity: high · Sectors: government-national, technology
Canonical: https://vorant.io/reports/649b124e-94bf-5ca6-92ca-7bf779930399/sharepoint-server-rce-via-deserialization-actively-exploited

> CISA confirms active exploitation of critical unauthenticated remote code execution vulnerabilities in Microsoft SharePoint Server.

Multiple critical vulnerabilities in Microsoft SharePoint Server enable unauthenticated remote code execution through deserialization of untrusted data and path traversal attacks. CVE-2025-53770 (deserialization flaw) and CVE-2025-53771 (path traversal) are actively being exploited in the wild under the designation "ToolShell," granting attackers full access to SharePoint content, file systems, internal configurations, and code execution capabilities over the network without authentication.

These vulnerabilities affect SharePoint Server Subscription Edition (prior to KB5002768), SharePoint Server 2019 Core (prior to KB5002754), SharePoint Server 2019 Language Pack (prior to KB5002753), SharePoint Enterprise Server 2016 (prior to KB5002760), and SharePoint Enterprise Server 2016 Language Pack (prior to KB5002759). The flaws represent incomplete remediation of previously patched vulnerabilities (CVE-2025-49704 and CVE-2025-49706), with attackers using advanced deserialization techniques and ViewState abuse to bypass earlier fixes.

Microsoft released patches on July 20, 2025. Organizations must apply updates immediately after testing, implement network segmentation to isolate SharePoint systems, enforce least-privilege access controls, and conduct vulnerability scanning to identify exposed instances.

## Mentioned in this report

- Vulnerabilities: CVE-2025-49704 (KEV), CVE-2025-49706 (KEV), CVE-2025-53770 (KEV), CVE-2025-53771 (weaponized)
- Campaigns: ToolShell

## Detection guidance (public sample)

### SharePoint IIS Worker Process Spawning Command Shell

ATT&CK: T1190

w3wp.exe running a SharePoint application pool spawns cmd.exe or PowerShell, consistent with post-exploitation after SharePoint deserialization RCE (ToolShell). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SharePoint IIS Worker Process Spawning Command Shell
description: Detects a w3wp.exe worker process hosting a SharePoint application pool
  spawning cmd.exe or PowerShell. This is the typical post-exploitation pattern after
  unauthenticated deserialization RCE in SharePoint (CVE-2025-53770 / ToolShell).
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: SharePoint
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  condition: selection
falsepositives:
- Custom SharePoint farm solutions or web parts that deliberately shell out to cmd
  or PowerShell
level: high
id: e820b79b-d4a7-58eb-a86e-7930ec9c6069
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-sharepoint-server-could-allow-for-remote-code-execution_2025-066---updated-was-emailed-as-2025-065-in-email-notification-should-have-been-2025-066
```

### ASPX Web Shell Written to SharePoint LAYOUTS Directory by Worker or Shell Process

ATT&CK: T1190

An .aspx file is created in the SharePoint TEMPLATE\LAYOUTS folder by w3wp, PowerShell or cmd, as seen when ToolShell drops a web shell to steal machine keys. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ASPX Web Shell Written to SharePoint LAYOUTS Directory by Worker or Shell Process
description: Detects creation of .aspx files under the SharePoint TEMPLATE\LAYOUTS
  directory by w3wp.exe, PowerShell or cmd.exe. Post-exploitation of CVE-2025-53770
  drops a web shell here to extract ASP.NET machine keys. Matches on the location
  and creating process, not a specific filename.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \w3wp.exe
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
    TargetFilename|contains|all:
    - \web server extensions\
    - \TEMPLATE\LAYOUTS\
    TargetFilename|endswith: .aspx
  condition: selection
falsepositives:
- Administrators deploying custom layout pages with PowerShell scripts during SharePoint
  solution deployment
level: high
id: 4dab0b95-0266-5b75-9e83-5cb9fb35cc09
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-sharepoint-server-could-allow-for-remote-code-execution_2025-066---updated-was-emailed-as-2025-065-in-email-notification-should-have-been-2025-066
```

### SharePoint ToolPane.aspx Exploitation Attempt with SignOut Referer

ATT&CK: T1190

POST requests to ToolPane.aspx with DisplayMode=Edit and a SignOut.aspx referer, the request pattern used to exploit SharePoint ToolShell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SharePoint ToolPane.aspx Exploitation Attempt with SignOut Referer
description: Detects POST requests to /_layouts/15/ToolPane.aspx with DisplayMode=Edit
  and a SignOut.aspx referer in web server logs. This is the request pattern used
  to deliver the deserialization payload in the ToolShell exploitation of CVE-2025-53770
  / CVE-2025-53771.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|endswith: /ToolPane.aspx
    cs-uri-query|contains: DisplayMode=Edit
    cs-referer|contains: SignOut.aspx
  condition: selection
falsepositives:
- Vulnerability scanners or red team exercises replaying the public ToolShell exploit
  against SharePoint
level: high
id: 06b54eaf-37a6-577b-a779-b7a83721c8eb
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-sharepoint-server-could-allow-for-remote-code-execution_2025-066---updated-was-emailed-as-2025-065-in-email-notification-should-have-been-2025-066
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-sharepoint-server-could-allow-for-remote-code-execution_2025-066---updated-was-emailed-as-2025-065-in-email-notification-should-have-been-2025-066

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/649b124e-94bf-5ca6-92ca-7bf779930399/sharepoint-server-rce-via-deserialization-actively-exploited.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup