Microsoft SharePoint Server Remote Code Execution Vulnerability
Priority CRITICAL 100Exploited in the wildCWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.
Summary
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Why it matters now
Exploitation Active In CISA KEV since 2025-07-20CISA due date 2025-07-21Known ransomware use
EPSS 0.99999 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed Microsoft: 3 updates
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 to before 16.0.5513.1001 | 16.0.5513.1001 | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 to before 16.0.10417.20037 | 16.0.10417.20037 | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server Subscription Edition | 16.0.0 to before 16.0.18526.20508 | 16.0.18526.20508 | Patch available | CNA |
- Microsoft SharePoint Enterprise Server 2016 VendorMicrosoft Affected 16.0.0 to before 16.0.5513.1001 Fixed in 16.0.5513.1001 Patch available CNA
- Microsoft SharePoint Server 2019 VendorMicrosoft Affected 16.0.0 to before 16.0.10417.20037 Fixed in 16.0.10417.20037 Patch available CNA
- Microsoft SharePoint Server Subscription Edition VendorMicrosoft Affected 16.0.0 to before 16.0.18526.20508 Fixed in 16.0.18526.20508 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* | before 16.0.18526.20508 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* Versions before 16.0.18526.20508 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
Remediation
Vendor assessments
Microsoft
Microsoft's page for this CVE →
- Impact
- Remote Code Execution
- Exploited
- Yes
- Publicly disclosed
- No
- Exploitability
- Exploitation Detected
| Product | Status | Plan or fix |
|---|---|---|
| Microsoft SharePoint Server 2019 | Fixed | 16.0.10417.20037 · Security Update |
| Microsoft SharePoint Server Subscription Edition | Fixed | 16.0.18526.20508 · Security Update |
Timeline
- 2025-07-20 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-53770
- 2026-10-03 Alias added: GHSA-xcrc-8vqv-vc8r
References
Exploit 3
More Microsoft Sharepoint Server vulnerabilities
- TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-13749 Microsoft SharePoint Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2019-00394 Improper input validation in Microsoft SharePoint Server KEVCVSS 3.1CRITICAL 9.8
- TI-2026-40539 Microsoft SharePoint Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-53770 · CVE Program
- CVE-2025-53770 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-xcrc-8vqv-vc8r · GitHub Advisory Database · CC BY 4.0
- CVE-2025-53770 · Microsoft Security Update Guide
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences