0day Vulnerability in Microsoft Sharepoint Exploited in-the-Wild (Campaign)

Microsoft disclosed two zero-day vulnerabilities in on-premises SharePoint (CVE-2025-53770: unsafe deserialization RCE and CVE-2025-53771: authentication bypass via Referer spoofing) that were actively exploited in the wild as part of a chained exploit called ToolShell. Attackers bypass authentication with a spoofed POST to the ToolPane endpoint, submit serialized payloads that trigger unsafe deserialization to drop an ASPX webshell (spinstall0.aspx), extract machineKeys, and then sign ViewState payloads to achieve arbitrary code execution; emergency patches were issued after exploitation was observed in mid-July 2025.