SharePoint zero-day: What we know

Microsoft warned that attackers are actively exploiting multiple SharePoint vulnerabilities — including zero‑day CVE‑2025‑53770 (CVSS 9.8) — via a ToolShell chain to deploy backdoors and steal system keys on on‑premises SharePoint (Subscription Edition, 2019, 2016). A PoC disclosed at Pwn2Own was rapidly weaponized and, since mid‑July, scans and reports indicate numerous compromises across U.S. federal/state agencies, critical infrastructure, higher education and telecommunications; Microsoft and CISA have released patches and mitigation steps (rotate machine keys, enable AMSI, use AV/EDR).