Actively exploited in the wild
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft - SharePoint · Listed in the CISA KEV since 2025-07-20. This indicates confirmed attacks in production environments.
Required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
CVE-2025-53770
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware of an exploit in the wild and is preparing an update.
Risk Assessment
An attacker can remotely execute code on the SharePoint server, potentially leading to server compromise and data breach. Immediate mitigation is recommended.
Recommendation
Implement mitigations described in the CVE documentation and monitor Microsoft communications for updates.
Other vulnerabilities in Microsoft SharePoint Server
See all- CVE-2017-8569High
Microsoft SharePoint Server has an elevation of privilege vulnerability due to improper sanitization of a specially crafted web request to an affected SharePoint server.
- CVE-2023-33160High
A vulnerability in Microsoft SharePoint Server allows remote code execution by an attacker. Exploiting this flaw could lead to system takeover.
- CVE-2023-29357CriticalActively exploited
Elevation of Privilege vulnerability in Microsoft SharePoint Server. Technical details are not provided in the description.
- CVE-2023-24955HighActively exploited
Microsoft SharePoint Server Remote Code Execution Vulnerability.
- CVE-2021-34467High
Vulnerability in Microsoft SharePoint Server allows remote code execution. An attacker could exploit it to run arbitrary code on the SharePoint server.
- CVE-2021-34519Medium
Information disclosure vulnerability in Microsoft SharePoint Server. An attacker could exploit this flaw to gain access to information that should be protected.
- CVE-2021-27076High
Remote Code Execution vulnerability in Microsoft SharePoint Server. Details are not provided in the description.
- CVE-2020-1069High
A remote code execution vulnerability in Microsoft SharePoint Server due to failure to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker could exploit it by creating a specially crafted page. The update corrects how SharePoint Server handles processing of created content.
- CVE-2023-36894Medium
A vulnerability in Microsoft SharePoint Server allows for information disclosure, potentially leading to unauthorized access to sensitive data.
- CVE-2023-36892High
A vulnerability in Microsoft SharePoint Server allows for spoofing, which may lead to unauthorized access to user data. An attacker can exploit this flaw to impersonate a trusted source.
Original NVD description (English source)
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.