A zero-day in on-premises SharePoint let attackers run code and steal server keys. Why patching had to be followed by rotating machine keys.
Publicly disclosed: 19 July 2025
On 19 July 2025 Microsoft published guidance about active attacks on on-premises SharePoint servers. The vulnerability, nicknamed “ToolShell”, allowed unauthenticated remote code execution; it bypassed a fix released earlier that month. Attackers planted web shells and stole the ASP.NET machine keys, which let them keep access even after patching.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2025-53770 | Critical, CVSS 9.8 (deserialization, remote code execution) | SharePoint Server 2016, 2019 and Subscription Edition (on-premises) | Emergency security updates from July 2025 |
SharePoint Online in Microsoft 365 was not affected.
.aspx files in the SharePoint layouts folders, and investigate if found.After a key-stealing attack, a patch locks the door — but you still have to change the keys.
Sources: Microsoft MSRC guidance, NVD CVE-2025-53770.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.