Back to the CVE list
CVE-2025-53770 CISA KEV · Actively exploitedLinked to ransomwareSuited to automated attack · CISA

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS score

9.8

EPSS probability

%100.0

Risk score

19.6

Published

1 y ago

OverviewPublic Exploits (12)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
mfarshad-abdullah-khan/cve-2025-53770-research
GitHub

🚨 Threat intel & incident response research on SharePoint "ToolShell" RCE zero-day (CVE-2025-53770). 🕵️‍♂️ Covers root-cause deserialization flaws, attack timelines, risk metrics, and defensive EDR validation playbooks. 🛡️

Public PoCSource updated: 04.08.2026 12:27:15
G
ZephrFish/CVE-2025-53770-Scanner
GitHub

ToolShell scanner - CVE-2025-53770 and detection information

Public PoCSource updated: 30.07.2026 13:45:09
G
Zedocun/SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis
GitHub

Technical analysis of a SharePoint ToolShell (CVE-2025-53770) exploitation attempt involving RCE, webshell deployment, and MachineKey extraction.

Public PoCSource updated: 18.04.2026 06:55:51
G
J4ck3LSyN-Gen2/CVE-2025-53770
GitHub

Lab & PoC

Public PoCSource updated: 30.07.2026 15:06:33
G
Rabbitbong/OurSharePoint-CVE-2025-53770
GitHub

Do you really think SharePoint is safe?

Public PoCSource updated: 14.10.2026 12:38:13
G
rbctee/CVE-2025-53770
GitHub

Scanner for the SharePoint CVE-2025-53770 RCE zero day vulnerability (fork from hazcod/CVE-2025-53770)

Public PoCSource updated: 24.07.2026 01:37:55
G
hazcod/CVE-2025-53770
GitHub

Scanner for the SharePoint CVE-2025-53770 RCE zero day vulnerability.

Public PoCSource updated: 02.10.2026 19:57:29
E
Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
Exploit-DB

Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)

Exploit referenceSource updated: 11.08.2025 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53770.yaml
Nuclei

Nuclei: Microsoft SharePoint Server - Remote Code Execution (ToolShell)

Exploit reference
N
https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/
NVD reference

https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/

Exploit reference
G
kaizensecurity/CVE-2025-53770
GitHub

https://github.com/kaizensecurity/CVE-2025-53770

Exploit reference
N
https://research.eye.security/sharepoint-under-siege/
NVD reference

https://research.eye.security/sharepoint-under-siege/

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-53770"