CVE-2025-53770: Microsoft SharePoint Vulnerability

What is CVE-2025-53770?

Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

Impact Analysis

Exploitation Probability (EPSS): 88.2% chance of exploitation in the next 30 days (100th percentile). This places the vulnerability in the highest risk tier — immediate action is critical.

Exploit Availability

Public exploit code or proof-of-concept is available for CVE-2025-53770. This significantly increases the risk of exploitation, as attackers can use or adapt existing exploit code rather than developing their own. A public exploit reference has been identified. Organizations should treat this as an urgent patching priority.

Is CVE-2025-53770 being exploited?

Yes. CVE-2025-53770 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, restricted to CVEs with confirmed active exploitation in the wild. CISA added this vulnerability on 2025-07-20. Inclusion in KEV triggers the patching mandate under BOD 22-01 for U.S. federal civilian agencies, with a remediation deadline of 2025-07-21. Additionally, public exploit code is available, which lowers the barrier for attackers.

How to fix CVE-2025-53770

Apply the latest security update via Windows Update, WSUS, or Microsoft Update Catalog. For enterprise environments, use SCCM/Intune for managed deployment. If the patch cannot be applied immediately, check the MSRC advisory for workarounds such as registry-based mitigations or disabling affected features. Check the Microsoft Security Response Center page for the specific patch or update. CISA's Known Exploited Vulnerabilities catalog requires U.S. federal agencies to remediate this vulnerability by the due date shown below under Binding Operational Directive 22-01. Private organizations should treat KEV entries as priority-one patches because active exploitation has been confirmed in the wild.

Related Vulnerabilities

Other actively exploited vulnerabilities affecting SharePoint:

• CVE-2026-20963 (Critical 9.8) [same product] — Deserialization of untrusted data in Microsoft Office SharePoint allows an…
• CVE-2025-49704 (High 8.8) [same product] — Improper control of generation of code ('code injection') in Microsoft Office…
• CVE-2025-49706 (Unknown N/A) [same product] — Microsoft SharePoint contains an improper authentication vulnerability that…
• CVE-2008-4250 (Critical 9.8) [same vendor] — The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003…
• CVE-2009-1537 (High 8.8) [same vendor] — Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll…

Frequently asked questions

Is CVE-2025-53770 critical?

CVE-2025-53770 has a CVSS 3.1 base score of N/A — Unknown severity. Prioritize based on exposure and the active exploitation signal from the KEV listing. The availability of public exploit code further increases the urgency.

Is CVE-2025-53770 being actively exploited?

Yes — CISA added CVE-2025-53770 to the Known Exploited Vulnerabilities catalog on 2025-07-20. Inclusion in KEV means CISA has confirmed in-the-wild exploitation. Public exploit code has also been identified, making exploitation accessible to a broader range of threat actors.

How do I patch CVE-2025-53770?

Apply the security update from Microsoft for SharePoint. Federal agencies must remediate by 2025-07-21 under BOD 22-01. Refer to the Microsoft Security Response Center for the official patch.

What is the CVSS score for CVE-2025-53770?

CVE-2025-53770 has a CVSS 3.1 base score of N/A, classifying it as Unknown severity.