SharePoint servers: Deserialization of untrusted data leading to remote code execution in on-premises Microsoft SharePoint Server (CVE-2025-53770) #shorts

Summary

Welcome to ThreatCast, your weekly breakdown of the latest cybersecurity alerts. Today we cover CVE-2025-53770, a critical zero-day in on-premises Microsoft SharePoint Server that’s under active exploitation. With no patch available yet, organizations must implement mitigation guidance and stay vigilant.

Product details

This vulnerability affects three SharePoint offerings: SharePoint Enterprise Server 2016 (all builds), SharePoint Server 2019 up to build 16.0.10417.20037, and SharePoint Server Subscription Edition up to build 16.0.18526.20508. If you run any of these on-premises, you are at risk until updates are released.

Vulnerability type summary

CVE-2025-53770 is classified as CWE-502: Deserialization of Untrusted Data. Attackers can craft malicious payloads that, when processed by the SharePoint deserializer, lead to remote code execution on the server.

Details of the vulnerability

Microsoft discovered that SharePoint’s object deserialization logic doesn’t properly validate data from untrusted sources. An unauthenticated attacker on the network can send a specially crafted request to a vulnerable server, triggering execution of arbitrary code with the same privileges as the SharePoint service. CISA has added this flaw to its Known Exploited Vulnerabilities Catalog and warns of active attacks in the wild. While Microsoft prepares a full patch, you should apply the documented mitigation—restrict inbound access to SharePoint management endpoints, enable Microsoft Defender for HTTP scanning, and monitor logs for suspicious object deserialization attempts.

Conclusion

CVE-2025-53770 is a serious zero-day impacting on-premises SharePoint installations with active exploitation reported. Until Microsoft’s update is released, follow CISA and Microsoft guidance: harden network access, deploy the provided mitigations, and use Defender’s web protection features. Stay tuned for our next episode when we’ll cover the patch release and post-mortem recommendations.

Watch the full video on YouTube: CVE-2025-53770

Remediation and exploitation details

This chain involves the following actors

  • Unauthorized Attacker: Exploits the deserialization flaw to gain code execution
  • System Administrator: Implements mitigations and updates to defend against exploitation

This following systems are involved

  • SharePoint Server Enterprise 2016 (On-premises collaboration platform): Hosts the vulnerable deserialization endpoint
  • SharePoint Server 2019 (On-premises collaboration platform): Hosts the vulnerable deserialization endpoint
  • SharePoint Server Subscription Edition (On-premises collaboration platform): Hosts the vulnerable deserialization endpoint

Attack entry point

  • Deserialization Interface: An endpoint in the SharePoint web application that accepts serialized objects over HTTP and recreates objects without validation

Remediation actions

System Administrator
Implement the interim CISA mitigation: block or restrict access to the vulnerable deserialization endpoint via web application firewall rules
SharePoint Server
System Administrator
Enable the Microsoft Defender for Identity workaround to monitor and quarantine malicious deserialization traffic
SharePoint Server
System Administrator
Apply the forthcoming Microsoft security update as soon as it is released to fully resolve the vulnerability
SharePoint Server

Exploitation actions

Injection of crafted binary or text-based serialized data

Unauthorized Attacker
Craft a malicious serialized payload that includes a specially formatted object graph to trigger unsafe deserialization routines
SharePoint Server
Examples:
  • A .NET BinaryFormatter stream containing a malicious gadget chain
  • A JSON payload with type metadata pointing to a system command execution assembly

HTTP POST with malicious body or SOAP envelope

Unauthorized Attacker
Send the malicious payload in an HTTP request to the SharePoint deserialization endpoint
SharePoint Server
Examples:
  • curl -X POST https://sharepoint.example.com/_vti_bin/ListData.svc -d @exploit.bin
  • POST to _api/web/lists with crafted request body

Remote deserialization invocation

Unauthorized Attacker
Trigger the server’s deserialization logic by invoking the vulnerable API call
SharePoint Server
Examples:
  • Accessing the list data service with the malicious payload attached
  • Calling a custom web service that uses the same deserialization library

Execution of deserialized payload

Unauthorized Attacker
Achieve remote code execution when the server instantiates the malicious object chain
SharePoint Server
Examples:
  • Launching cmd.exe or PowerShell on the host
  • Dropping a reverse shell binary on disk

Post-exploitation tooling

Unauthorized Attacker
Establish persistent access and move laterally within the network
SharePoint Server
Examples:
  • Deploying a backdoor service
  • Extracting credentials from memory

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-53770
Description
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Provider
microsoft
CWE / problem types
CWE-502: Deserialization of Untrusted Data
Affected Software Versions
Microsoft:Microsoft SharePoint Enterprise Server 2016:[{'version': 'N/A', 'status': 'affected'}],Microsoft:Microsoft SharePoint Server 2019:[{'version': '16.0.0', 'lessThan': '16.0.10417.20037', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Microsoft SharePoint Server Subscription Edition:[{'version': '16.0.0', 'lessThan': '16.0.18526.20508', 'versionType': 'custom', 'status': 'affected'}]
Date Published
2025-07-20T01:06:33.607Z
Last Updated
2025-07-21T01:26:28.544Z