Attackers Exploit Zero-Day Flaws in On-Premises SharePoint

Hackers are actively exploiting two zero-day vulnerabilities in on-premises installations of Microsoft SharePoint to remotely compromise servers, as well as steal cryptographic keys and data, said security experts.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

The ongoing attack campaign, targeting a vulnerability chain nicknamed ToolShell, “provides unauthenticated access to systems and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network,” said the U.S. Cybersecurity and Infrastructure Security Agency in a Sunday alert.

“This is a high-severity, high-urgency threat,” said Michael Sikorski, CTO and head of threat intelligence for Unit 42 at Palo Alto Networks. “While cloud environments remain unaffected, on-prem SharePoint deployments – particularly within government, schools, healthcare including hospitals, and large enterprise companies – are at immediate risk.”

The ToolShell-targeting campaign appeared to begin Friday evening, before rapidly expanding, said researchers at cybersecurity firm Eye Security. By Saturday, attackers successfully gained access to “dozens of servers” and each time “planted a shell that leaked sensitive key material, enabling complete remote access,” it said.

Security experts said organizations should treat all on-premises SharePoint systems as compromised – until proven otherwise – and immediately apply patches from Microsoft, if available, as well as rotate cryptographic keys and review indicators of compromise for signs they were already breached.

“Organizations must assume compromise if their SharePoint instance was exposed to the internet before patching and should validate that machine keys were not accessed,” said Charles Carmakal, CTO of Mandiant Consulting, in a Sunday post to LinkedIn. “This is not just a patch-and-move-on incident.”

CISA advised all organizations with on-premises SharePoint servers to immediately implement mitigations or else temporarily disconnect servers from public-facing internet services.

“All signs point to widespread, mass exploitation – with compromised government, technology and enterprise systems observed globally,” said watchTowr CEO Benjamin Harris. “Attackers are deploying persistent backdoors, and notably, are taking a more sophisticated route than usual: the backdoor retrieves SharePoint’s internal cryptographic keys – specifically the MachineKey used to secure the __VIEWSTATE parameter.”

The ToolShell attack chain involves exploiting two zero-day vulnerabilities: CVE-2025-53770 and CVE-2025-53771.

The first flaw is a variant of a code injection flaw in SharePoint, CVE-2025-49704, which the U.S. National Vulnerability said “allows an authorized attacker to execute code over a network.” The second flaw is a variant of CVE-2025-49706, which Microsoft said “allows an authorized attacker to perform spoofing over a network.”

Microsoft patched CVE-2025-49704 and CVE-2025-49706 on July 8. Researcher Khoa Dinh demonstrated at last week’s Pwn2Own Berlin 2025 conference how they could be used to create an unauthenticated exploit chain he dubbed ToolShell. On July 14, researchers at Germany’s Code Red penetration firm reported that they’d been able to reproduce the exploit chain, based on Dinh’s findings, as well as their discovering a different type of authentication bypass.

Whoever is behind the attack campaign that began Friday likewise appears to have discovered the latest form of ToolShell.

Microsoft said the new, emergency updates that it’s releasing for SharePoint now include “more robust protections” than before for the two vulnerabilities fixed on July 8, as well as fixes for the two new zero-day vulnerabilities.

CISA has added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog, instructing all federal civilian agencies to apply mitigations by Monday.

The FBI said it’s already coordinating with impacted government entities and private sector organizations amid concerns of widespread compromise.

Microsoft has now issued out-of-band patches for SharePoint Server Subscription Edition via KB5002768 and SharePoint Server 2019 via KB5002754. The company said it’s still testing a fix for SharePoint Server 2016.

“We strongly recommend customers apply the July 2025 security update, enable AMSI integration with Defender Antivirus and rotate machine keys,” Microsoft said in updated guidance released Monday, referring to its anti-malware scan interface. The company also recommended restarting Internet Information Services after rotating keys to ensure old – and possibly stolen – credentials get invalidated, thus blocking their further abuse by attackers.

According to Eye Security’s timeline, the first ToolShell exploitation wave began around 18:00 UTC on Friday, followed by a second wave Saturday at 07:30 UTC. The backdoor dropped by attackers in both instances exfiltrated only cryptographic configuration data and made no outbound calls, which researchers said made it difficult to detect.

“We observed suspicious POST requests targeting the ToolPane.aspx endpoint with referrers spoofed from the SignOut.aspx path,” Eye Security said in a blog post. “This was followed by the deployment of a custom backdoor named spinstall0.aspx,” which it said “harvested ASP.NET machine validation and decryption keys, which attackers then used to craft signed view-state payloads for subsequent code execution.”

Experts warned that attackers can maintain their access and code-execution capabilities even after patches get applied, unless administrators also rotate keys and invalidate the old keys.

“If an affected SharePoint instance is exposed to the internet, it should be treated as compromised until proven otherwise,” watchTowr’s Harris said.