Microsoft Rushes Emergency Patch for Actively Exploited SharePoint 'ToolShell' Bug

Microsoft patched a critical on-premises SharePoint zero-day (CVE-2025-53770, CVSS 9.8) and a related path traversal issue (CVE-2025-53771) after wide in-the-wild exploitation of an attack chain called "ToolShell" that permits unauthenticated remote code execution and full server takeover; the wave impacted US federal and state agencies and other organizations, prompting CISA action and urgent mitigation guidance including patches, Defender deployment, and disconnecting vulnerable systems.