Sharepoint

Microsoft dropped the CVE-2025-53770 advisory on a Saturday. For organizations without 24/7 Security Operations Centers, that timing was devastating. ToolShell represents everything that can go wrong in vulnerability disclosure: critical severity, unauthenticated exploitation, wide deployment, and a gap between disclosure and patch availability. By the time many teams saw the advisory, attackers were already inside. Understanding the Vulnerability Technical Details CVE: CVE-2025-53770 CVSS: Critical (9.8+) Type: Unauthenticated Remote Code Execution Affected: Microsoft SharePoint Server (multiple versions) Exploitation: Began within days of disclosure The Attack Path SharePoint is often deployed in perimeter-exposed configurations, making it reachable from the internet. Even when internal-facing, SharePoint’s tight integration with Active Directory means compromise leads directly to: ...