Cato CTRL™ Threat Brief: “ToolShell” Exploit Targeting Microsoft SharePoint Vulnerabilities 

On July 22, 2025 Microsoft disclosed a chain of critical SharePoint Server vulnerabilities being actively exploited via a multi-stage exploit dubbed "ToolShell," which achieves unauthenticated RCE, deploys web shells, exfiltrates cryptographic keys, and enables persistent signed payload execution; Microsoft observed exploitation by two named Chinese nation-state actors and issued emergency updates while Cato describes SASE/XDR protections to detect and block exploitation attempts.