CVE-2025-53770 is a deserialization of untrusted data vulnerability in Microsoft SharePoint. CISA added it to the Known Exploited Vulnerabilities catalogue on 20 July 2025, which means attackers have used it in real attacks. Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network.
What this vulnerability means in SharePoint
Deserialization flaws are dangerous because they let an attacker feed crafted data into code paths that recreate objects or state in unsafe ways. In a server product such as Microsoft SharePoint, that can turn a simple parsing bug into remote code execution if the application trusts input that should never be executable.
That matters especially in on-premises collaboration platforms, where the server often sits inside the corporate network and has direct access to documents, user data, and internal services. A successful exploit can therefore move from an application bug to a broader server compromise rather than stopping at the web layer.
Why this type of flaw is high impact
Deserialization vulnerabilities often sit close to the trust boundary between external requests and internal application logic. When that boundary fails, the attacker is no longer limited to reading a page or submitting a form, because the server may process attacker-controlled data as if it came from a trusted source.
For a product like SharePoint, the practical danger is that code execution can become a stepping stone to credential theft, data discovery, lateral movement, or persistence on a server that many users already trust. That is why Microsoft and the CVE Program are useful reference points for understanding the record itself, while the NIST National Vulnerability Database is the place to verify the structured vulnerability entry and associated metadata.
How organisations check exposure and confirm risk
Exposure checking starts with a complete asset inventory: which SharePoint instances exist, whether they are on-premises, and whether they are internet reachable or accessible through exposed reverse proxies, VPNs, or partner paths. The most important question is not only whether SharePoint is deployed, but whether the vulnerable server is reachable from untrusted networks.
Teams should also review vendor advisories and KEV status together, because the presence of an exploited CVE changes priority from routine remediation to urgent exposure review. NHIMG’s Vulnerability Management Guide is a useful companion for understanding asset scope, KEV-driven prioritisation, and verification after remediation.
Remediation, detection, and post-patch review
When patching is delayed, compensating controls matter: reduce internet exposure, restrict administrative access, segment the server, and apply vendor guidance as a temporary containment measure. If exploitation is suspected, patching alone is not enough, because attackers who achieved code execution may already have dropped web shells, stolen keys, or created durable access paths.
Detection should focus on signs of server-side compromise, unusual child processes, suspicious web content, unexpected outbound connections, and any changes to authentication material or service accounts used by the platform. After remediation, review whether the attacker touched secrets, tokens, machine keys, or other identity-bearing material that could preserve access even after the original flaw is fixed. The ToolShell SharePoint exploitation 2025 case is a useful reminder that post-patch persistence can survive if key material was stolen, and Microsoft’s own advisory should be used for the authoritative patch and version details.
Risk and Threat Considerations
This vulnerability is high risk because it combines unauthorised network reachability with potential server-side code execution on a widely deployed enterprise platform. Once an attacker can run code on a SharePoint server, the blast radius can extend beyond the application itself into stored content, service credentials, and adjacent internal systems.
Failure mechanism: The application accepts untrusted serialized input, reconstructs it unsafely, and allows attacker-controlled data to influence executable behaviour on the server.
Impact: Attackers may gain remote code execution, establish persistence, access internal data, and use the compromised server as a foothold for broader compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE demands prioritised exposure tracking and remediation. |
| Recommendation — Prioritise this CVE in your vulnerability workflow and verify remediation on exposed SharePoint servers. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Untrusted deserialization is a failure of safe input handling. |
| SI-4 — System Monitoring | Post-exploit compromise review depends on detection of server-side abuse. | |
| Recommendation — Validate and constrain external input before it reaches deserialization code paths. Monitor SharePoint hosts for anomalous processes, web shells, and suspicious outbound activity. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | The term is an exploited software vulnerability requiring controlled remediation. |
| Recommendation — Track this CVE as a technical vulnerability and verify remediation on all in-scope servers. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Unsafe deserialization is an application architecture weakness with security impact. |
| Recommendation — Eliminate unsafe deserialization patterns and redesign trust boundaries around untrusted input. | ||
| MITRE ATT&CK | T1203 — Exploitation for Client Execution | The flaw enables attacker-controlled execution through exploitation of application logic. |
| Recommendation — Map suspicious SharePoint exploitation activity to T1203 and hunt for follow-on execution on hosts. | ||
Practitioner Guidance
Why practitioners should care: Treat this as an exposure-management issue, not just an application bug. An exploited SharePoint server can become a trust anchor for the rest of the environment, so the response must include inventory, containment, compromise review, and credential hygiene where relevant.
What to watch for: Prioritise systems that are internet facing, externally reachable through published services, or used for sensitive collaboration. If compromise is suspected, validate whether any service accounts, session material, or cryptographic keys associated with the server need rotation after remediation.
Related resources from NHI Mgmt Group
- CVE-2025-59287 (Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data)
- CVE-2023-21529 (Microsoft Exchange Server Deserialization of Untrusted Data)
- CVE-2025-26399 (SolarWinds Web Help Desk Deserialization of Untrusted Data)
- CVE-2025-49113 (RoundCube Webmail Deserialization of Untrusted Data)