SharePoint “ToolShell” (CVE-2025-53770 / -53771; base bugs CVE-2025-49704 / -49706)
Exploited as a zero-day from 18 Jul 2025 (Eye Security).
- Disclosed
What happened
- Exploited as a zero-day from 18 Jul 2025 (Eye Security). Emergency patches 19 to 21 Jul.
- KEV: 20 Jul 2025 (-53770) and 22 Jul 2025 (-49704 / -49706).
- Scale: 400+ victim organizations, including US federal agencies. Linen Typhoon, Violet Typhoon and Storm-2603 (Warlock ransomware).
Live scores
Live scores
CVE-2025-49704- EPSS
- 1.000
very likely to be attacked soon - VEDAS
- 0.984
strong exploit evidence - On CISA KEV
- Yes, since 2025-07-22
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2025-49706- EPSS
- 0.991
very likely to be attacked soon - VEDAS
- 0.980
strong exploit evidence - On CISA KEV
- Yes, since 2025-07-22
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2025-53770- EPSS
- 1.000
very likely to be attacked soon - VEDAS
- 0.986
strong exploit evidence - On CISA KEV
- Yes, since 2025-07-20
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-53771- EPSS
- 0.999
very likely to be attacked soon - VEDAS
- 0.977
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Sources
- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
- https://research.eye.security/sharepoint-under-siege/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.