Microsoft SharePoint Improper Authentication Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
ToolShell
ToolShell is the name for a set of on-premises Microsoft SharePoint Server vulnerabilities that attackers exploited from July 2025. The name first described the chain of CVE-2025-49706 and CVE-2025-49704, which gives unauthorized access to on-premises SharePoint servers. Unit 42 also counts CVE-2025-53770 and CVE-2025-53771 as ToolShell, and Microsoft describes CVE-2025-53770 as related to CVE-2025-49704.
Updated
CVEs in ToolShell
4 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2025-49704KEV Microsoft SharePoint Remote Code Execution Vulnerability | Microsoft SharePoint Remote Code Execution Vulnerability | Microsoft | 8.8 | 100.0% | KEV | 2025-07-08 |
| CVE-2025-49706KEV Microsoft SharePoint Server Spoofing Vulnerability | Microsoft SharePoint Server Spoofing Vulnerability | Microsoft | 6.5 | 99.1% | KEV | 2025-07-08 |
| CVE-2025-53770KEV Microsoft SharePoint Server Remote Code Execution Vulnerability | Microsoft SharePoint Server Remote Code Execution Vulnerability | Microsoft | 9.8 | 100.0% | KEV | 2025-07-20 |
CVE-2025-53771 is part of ToolShell but has no record in this database.
What Each CVE Does
Microsoft SharePoint Code Injection Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Part of the ToolShell set of on-premises SharePoint Server flaws exploited from mid-July 2025. The name first described the CVE-2025-49706 and CVE-2025-49704 chain; Microsoft and Unit 42 also apply it to CVE-2025-53770, a deserialization variant enabling unauthenticated code execution.
ToolShell in the KEV Catalog
as of 2026-11-03| CVE | Added | Due | Ransomware |
|---|---|---|---|
| CVE-2025-49706 | 2025-07-22 | 2025-07-23 | Known use |
| CVE-2025-49704 | 2025-07-22 | 2025-07-23 | Known use |
| CVE-2025-53770 | 2025-07-20 | 2025-07-21 | Known use |
Affected Products
8 entries| CVE | Vendor | Product | Versions |
|---|---|---|---|
| CVE-2025-49706 | Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 to <16.0.5508.1000 |
| CVE-2025-49706 | Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 to <16.0.10417.20027 |
| CVE-2025-49706 | Microsoft | Microsoft SharePoint Server Subscription Edition | 16.0.0 to <16.0.18526.20424 |
| CVE-2025-49704 | Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 to <16.0.5508.1000 |
| CVE-2025-49704 | Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 to <16.0.10417.20027 |
| CVE-2025-53770 | Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 to <16.0.5513.1001 |
| CVE-2025-53770 | Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 to <16.0.10417.20037 |
| CVE-2025-53770 | Microsoft | Microsoft SharePoint Server Subscription Edition | 16.0.0 to <16.0.18526.20508 |
Frequently Asked Questions
What is ToolShell?→
ToolShell is the name for a set of on-premises Microsoft SharePoint Server vulnerabilities that attackers exploited from July 2025. The name first described the chain of CVE-2025-49706 and CVE-2025-49704, which gives unauthorized access to on-premises SharePoint servers. Unit 42 also counts CVE-2025-53770 and CVE-2025-53771 as ToolShell, and Microsoft describes CVE-2025-53770 as related to CVE-2025-49704.
Which CVEs are part of ToolShell?→
ToolShell covers four CVEs: CVE-2025-49706, CVE-2025-49704, CVE-2025-53770, and CVE-2025-53771. CVE-2025-53771 is part of ToolShell but has no record in this database.
Is ToolShell actively exploited?→
3 of the 4 ToolShell CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-11-03: CVE-2025-49706 (added 2025-07-22), CVE-2025-49704 (added 2025-07-22), and CVE-2025-53770 (added 2025-07-20).
How severe is ToolShell?→
The highest CVSS base score among the ToolShell CVEs is 9.8 (CRITICAL), for CVE-2025-53770.
Related
Vendors
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.