![\"Critical](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2025\/07\/sharepoint-hack.jpg\" "\\"Critical")
<\/a><\/p>\nA critical security vulnerability in Microsoft SharePoint Server has been weaponized as part of an “active, large-scale” exploitation campaign.<\/p>\n
The zero-day flaw, tracked as CVE-2025-53770 (CVSS score: 9.8), has been described as a variant of CVE-2025-49706<\/a> (CVSS score: 6.3), a spoofing bug in Microsoft SharePoint Server that was addressed<\/a> by the tech giant as part of its July 2025 Patch Tuesday updates.<\/p>\n “Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network,” Microsoft said<\/a> in an advisory released on July 19, 2025.<\/p>\n The Windows maker further noted that it’s preparing and fully testing a comprehensive update to resolve the issue. It credited Viettel Cyber Security for discovering and reporting the flaw through Trend Micro’s Zero Day Initiative (ZDI).<\/p>\n In a separate alert issued Saturday, Redmond said<\/a> it’s aware of active attacks targeting on-premises SharePoint Server customers, but emphasized that SharePoint Online in Microsoft 365 is not impacted.<\/p>\n In the absence of an official patch, Microsoft is urging customers to configure Antimalware Scan Interface (AMSI)<\/a> integration in SharePoint and deploy Defender AV on all SharePoint servers.<\/p>\n It’s worth noting that AMSI integration is enabled by default in the September 2023 security update for SharePoint Server 2016\/2019 and the Version 23H2 feature update for SharePoint Server Subscription Edition.<\/p>\n For those who cannot enable AMSI, it’s advised that the SharePoint Server is disconnected from the internet until a security update is available. For added protection, users are recommended to deploy Defender for Endpoint to detect and block post-exploit activity.<\/p>\n The disclosure comes as Eye Security<\/a> and Palo Alto Networks Unit 42<\/a> warned of attacks chaining CVE-2025-49706 and CVE-2025-49704<\/a> (CVSS score: 8.8), a code injection flaw in SharePoint, to facilitate arbitrary command execution on susceptible instances. The exploit chain has been codenamed ToolShell<\/a>.<\/p>\n But given that CVE-2025-53770 is a “variant” of CVE-2025-49706, it’s suspected that these attacks are related.<\/p>\n The malicious activity essentially involves delivering ASPX payloads via PowerShell, which is then used to steal the SharePoint server’s MachineKey<\/a> configuration, including the ValidationKey and DecryptionKey, to maintain persistent access.<\/p>\n The Dutch cybersecurity company said these keys are crucial for generating valid __VIEWSTATE payloads, and that gaining access to them effectively turns any authenticated SharePoint request into a remote code execution opportunity.<\/p>\n<\/a><\/p>\n