ToolShell Exploits: Inside CVE-2025-53770 And CVE-2025-53771’s Critical Threat To SharePoint

The “ToolShell” campaign primarily leverages two critical vulnerabilities within Microsoft SharePoint:

CVE-2025-53770: The Remote Code Execution Pathway

CVE-2025-53770 is a severe remote code execution (RCE) vulnerability, stemming from unsafe deserialization of untrusted data within SharePoint. With a staggering CVSS score of 9.8, this vulnerability allows attackers to execute arbitrary code on vulnerable servers without any form of authentication. The core of this flaw lies in how SharePoint processes certain crafted HTTP requests, particularly those targeting the /ToolPane.aspx endpoint. By manipulating these requests, attackers can inject malicious code that the server then deserializes and executes, effectively granting them full control over the compromised system. This can lead to a complete system takeover, data exfiltration, or the deployment of additional malicious payloads like ransomware

CVE-2025-53771: The Authentication Bypass Enabler

Complementing CVE-2025-53770, CVE-2025-53771 is an authentication bypass vulnerability. While CVE-2025-53770 facilitates code execution, CVE-2025-53771 often serves as an initial foothold or a mechanism to amplify the attack. This flaw allows threat actors to bypass security measures and access SharePoint as an unauthenticated user, effectively spoofing identities or evading detection. When chained with CVE-2025-53770, this authentication bypass enables attackers to achieve RCE without needing legitimate credentials, making the attack surface significantly broader and the threat more potent. The ability to gain unauthorized access allows attackers to establish initial presence, perform reconnaissance, and prepare the ground for the subsequent RCE

A Recurring Pattern: Patch Bypasses of Older CVEs

Both CVE-2025-53770 and CVE-2025-53771 are considered patch bypasses for earlier vulnerabilities, specifically CVE-2025-49704 and CVE-2025-49706. This means that even organizations that applied patches for the previous flaws may still be vulnerable if they haven’t implemented the latest emergency updates. This highlights the sophisticated nature of these attacks, where threat actors analyze and reverse-engineer patches to find new ways to exploit underlying weaknesses

The ToolShell vulnerabilities impact multiple versions of Microsoft SharePoint:

• SharePoint Server Subscription Edition
• SharePoint Server 2019
• SharePoint Server 2016
• SharePoint Server 2010 and 2013

Important Note: SharePoint Online in Microsoft 365 is not impacted by these vulnerabilities.

However, self-managed SharePoint instances, even if hosted in cloud environments such as Azure, AWS, or GCP, are still vulnerable unless patched

Threat actors employing the “ToolShell” exploits exhibit sophisticated and methodical approaches, often chaining CVE-2025-53771 (authentication bypass) with CVE-2025-53770 (RCE) to achieve comprehensive control over target systems

Their campaigns are characterized by several key stages and techniques:

Initial Access and Foothold

The attack often begins with reconnaissance to identify vulnerable on-premises SharePoint instances. Once a target is identified, attackers send specially crafted HTTP POST requests to the /_layouts/15/ToolPane.aspx endpoint. These requests often include a forged Referer header, such as /_layouts/SignOut.aspx, which tricks SharePoint into processing the malicious payload as if it were a legitimate, authenticated request, bypassing authentication mechanisms (leveraging CVE-2025-53771)

Remote Code Execution

Upon successful authentication bypass, the malicious payload is injected into the request, exploiting the unsafe deserialization vulnerability (CVE-2025-53770). This payload typically contains encoded PowerShell commands or loaders designed to execute arbitrary code on the server. The execution often occurs with high privileges, sometimes under the NT AUTHORITY\System account, granting attackers extensive control over the system. A common observed activity is the upload of malicious scripts, such as spinstall0.aspx, which serve as web shells for persistent access

Post-Exploitation Activities

Once RCE is achieved, threat actors engage in various post-exploitation activities to solidify their presence and achieve their objectives. These activities include:

• Establishing Persistence: Deploying web shells like “ToolShell” to maintain a backdoor for ongoing access
• Data Exfiltration: Stealing sensitive data, configuration files, and cryptographic secrets
• Lateral Movement: Mapping Active Directory structures and moving laterally within the network to expand their control
• Ransomware Deployment: In some cases, deploying ransomware to encrypt critical data and demand payment
• Harvesting Credentials: Gaining access to user credentials and enterprise configurations

According to intelligence from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and other security vendors, ToolShell has been weaponized by nation-state actors, including:

• Linen Typhoon (China)
• Violet Typhoon (China)
• Storm-2603

These groups are targeting a broad range of sectors, including:

• Finance
• Healthcare
• Education
• Energy

Their involvement underscores the global and strategic nature of the campaign.

of these exploits

Key Consequences of Successful Exploitation:

Immediate Actions (Per Microsoft Security Guidance)

Organizations should urgently apply Microsoft’s emergency out-of-band security updates

Microsoft has released a set of IOCs tied to the ToolShell campaign. These include malicious file names, IPs, and behavior signatures.

The ToolShell vulnerabilities—CVE-2025-53770 and CVE-2025-53771—are a vivid example of how incomplete patching and evolving tactics can result in highly effective attack chains. With unauthenticated RCE now a reality for vulnerable SharePoint instances, the need for swift action is non-negotiable

Organizations must treat this as a critical incident:

• Patch immediately
• Strengthen monitoring
• Educate staff
• Harden network defenses

As exploitation campaigns continue to evolve, proactive cybersecurity posture and timely remediation remain the best defense

At Wizard Cyber, we offer proactive protection and incident response to mitigate threats like these:

Our Services Include:

• Managed Microsoft Sentinel
• CyberShield XDR
• 24/7 Managed Detection and Response (MDR)
• Comprehensive Vulnerability Management Service
• Security Advisories for Threats and Vulnerabilities

Our global SOC team works around the clock to monitor for dark web activity, detect breaches early, and help you harden your identity and access security.