CVE-2025-53770: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CVE-2025-53770 is a deserialization of untrusted data vulnerability in Microsoft SharePoint Server on-premises. An unauthorized attacker can use it to execute code over the network. It matters because it is a known ransomware vector, can be chained with CVE-2025-53771, and acts as a patch bypass for the earlier CVE-2025-49704; the updates for this CVE supply more robust protection than those earlier fixes. Confirm all product and version details against the current Microsoft advisory.

How it works

The weakness is CWE-502: deserialization of untrusted data. SharePoint Server processes serialized objects that an attacker can influence. When the application deserializes that data without adequate validation, the attacker can cause the runtime to instantiate unexpected types or invoke methods that lead to remote code execution. Because the flaw is reachable over the network by an unauthorized party, successful abuse can give the attacker the ability to run code in the context of the SharePoint process. Public detail on exact gadget chains or request formats is limited; treat any claimed exploit mechanics as unconfirmed until verified against the vendor advisory. The same advisory notes that this CVE can be chained with CVE-2025-53771 and that prior patches for CVE-2025-49704 were incomplete.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft SharePoint Server on-premises installations. Cloud-hosted SharePoint Online is outside the scope described by CISA for this CVE, but organizations should still confirm their exact deployment model. Typical locations include internal collaboration farms, extranet portals, and any public-facing SharePoint sites that have not been retired.

• Inventory every SharePoint Server instance: check Windows Server roles, IIS sites, and SharePoint Central Administration for farm topology and build numbers.
• Identify end-of-life or end-of-service releases, explicitly including SharePoint Server 2013 and earlier; these must be treated as high priority for disconnection if public-facing.
• For supported versions, compare the installed build and cumulative update level against the Microsoft security update that addresses CVE-2025-53770; do not rely on earlier patches issued for CVE-2025-49704.
• Review network exposure: any SharePoint endpoint reachable from untrusted networks (internet, partner extranets) increases risk.
• Look for anomalous process creation, unexpected .NET deserialization activity, or unusual web requests targeting SharePoint application pages or web services in IIS and SharePoint ULS logs. Correlate with endpoint detection alerts for code execution under the SharePoint application pool identity.

Specific version ranges and detection signatures must be confirmed against the vendor advisory and CISA guidance.

How to remediate

Apply the Microsoft security update that specifically addresses CVE-2025-53770; the vendor states these updates include more robust protection than the earlier fixes for CVE-2025-49704. After patching, restart the affected services and verify the new build number in Central Administration or via PowerShell.

• Immediately disconnect any public-facing SharePoint Server instances that have reached end-of-life or end-of-service, including SharePoint Server 2013 and earlier, as required by CISA.
• For still-supported versions, follow the full set of mitigations published by Microsoft and the corresponding CISA instructions.
• If the product is used as a cloud service, adhere to BOD 22-01 guidance or discontinue use if mitigations are unavailable.
• After remediation, re-inventory the farm, confirm no residual unpatched nodes remain, and validate that previously public-facing EOL systems stay offline or are fully decommissioned.

If you can't patch immediately

Reduce exposure while preparing the official update.

• Remove public internet access to all SharePoint Server endpoints; place them behind VPN, reverse-proxy authentication, or network segmentation that restricts source IPs to known administrative and user networks.
• Disable or restrict any SharePoint features or web services that accept serialized input if the vendor documentation identifies them as attack surface; confirm exact configuration steps in the advisory.
• Deploy virtual patching or WAF rules that block known malicious deserialization patterns for .NET applications, understanding that such rules are temporary and may produce false positives.
• Increase monitoring: alert on anomalous process launches from w3wp.exe or the SharePoint application pools, unexpected outbound connections, and creation of new administrative accounts or scheduled tasks.
• For EOL systems that cannot be patched, the only reliable compensating control is complete disconnection from untrusted networks until the systems are replaced or retired.

If your data may have been exposed

Actively exploited vulnerabilities of this class, especially those with confirmed ransomware use, frequently lead to full farm compromise, data theft, and encryption. Assume that any unpatched, network-reachable SharePoint Server could have been abused. Review access logs, check for unauthorized file downloads or modifications, and rotate credentials for service accounts and farm administrators. Organizations can also run a free exposure scan of their email addresses against known breach data sets to determine whether related credentials or personal information have already appeared in public dumps.