SharePoint Under Attack: CVE-2025-53770 ToolShell Zero-Day and What You Need to Know

The Attack Chain: How ToolShell Works

The ToolShell vulnerability exploits SharePoint's form processing endpoint. Understanding the attack chain helps you understand why it's so dangerous.

An attacker sends a specially crafted HTTP POST request to SharePoint's /_layouts/ endpoint (typically /_layouts/15/toolsh.aspx or similar form endpoints). This endpoint is designed to handle form submissions from authenticated users, but the vulnerability bypasses authentication checks.

The malicious payload is embedded in form parameters. SharePoint processes the form and executes the attacker's payload as part of form processing, without validating that the user is authenticated or authorized. The payload can be arbitrary code that executes on the server.

Code execution occurs with the privileges of the SharePoint application pool identity. In most environments, this is a high-privilege service account that can read/write SharePoint databases, access file shares, and interact with domain services.

The attacker can then: establish persistence (create admin accounts, backdoors), steal data (exfiltrate SharePoint content, databases), move laterally (use SharePoint access to attack other systems), or disrupt operations (delete data, lock users out).

• POST request to /_layouts/ endpoint bypasses authentication
• Malicious payload embedded in form parameters
• Code executes with SharePoint application pool privileges
• Attacker gains server-level access, not just SharePoint
• Lateral movement to domain and other systems possible

Affected Versions and What's NOT Affected

SharePoint on-premises versions 2016, 2019, and Subscription Edition (2021+) are all affected until patched. SharePoint Online is NOT vulnerable because Microsoft controls the infrastructure and has already deployed mitigations.

Affected: SharePoint Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition (2021, 2022, 2023, 2024 editions). All on-premises deployments are vulnerable regardless of cumulative update level, until you apply May 2025 or later updates.

NOT affected: SharePoint Online (Microsoft 365). If your organization migrated to SharePoint Online, you are automatically protected.

Special consideration: SharePoint Server 2013 is out of support and will not receive a patch. Organizations still running 2013 should assume this vulnerability affects their systems and plan immediate migration or isolation.

Detection: Identifying ToolShell Exploitation

Detecting exploitation requires analyzing multiple sources: IIS logs, SharePoint usage logs, and system activity. Forensic analysis is complex but critical.

IIS logs: Look for POST requests to /_layouts/ endpoints from unknown sources. These should be rare — most form submissions come from authenticated users. An attacker's exploit will appear as POST requests without prior authentication (no session cookies, suspicious headers). Filter logs for HTTP 200 responses (successful exploitation) to POST requests that should typically fail.

SharePoint usage logs: Check ULS (Unified Logging Service) logs for unexpected form processing events, particularly errors and exceptions during form submission. Look for 'unexpected form input' or 'unvalidated form data' entries.

New accounts and permissions: Attackers often create admin accounts for persistence. Review user accounts created around May 2025 — look for system accounts, service accounts, or suspicious user names. Check for unexpected permission grants.

System activity: Check Windows event logs for unexpected process execution, registry modifications, or network connections. Look for PowerShell execution (common for post-exploitation), creation of new services, or scheduled tasks.

Critical Mitigation Steps: Immediate Actions

Patching is urgent, but you need a comprehensive mitigation strategy that includes patching, detection, forensics, and segmentation.

Step 1 — Patch immediately: Deploy May 2025 or later cumulative updates to all SharePoint servers. This is the primary defense. Plan downtime and test in staging first, but don't delay deployment.

Step 2 — Conduct forensics: Before and after patching, analyze logs to determine if exploitation has occurred. Assume breach if you find evidence of exploitation. Engage incident response and legal.

Step 3 — Network segmentation: Implement network policies to restrict what a compromised SharePoint server can access. If a server is compromised, limit lateral movement to domain controllers, file servers, and other critical systems.

Step 4 — Monitoring and alerting: Implement continuous monitoring of /_layouts/ endpoints. Alert on suspicious POST requests, especially from unauthenticated sources.

Step 5 — Plan migration: While you patch, plan migration to SharePoint Online. Cloud instances are immune to this vulnerability and simplify security management long-term.

Frequently Asked Questions

Sources

• Microsoft Security Update for SharePoint
• CVE-2025-53770 Detailed Analysis

Related Articles

Web Design

Website Security Best Practices for Small Businesses in 2026

Small businesses have different risk profiles and budgets than enterprises. This guide covers the security practices that deliver the best return on investment for small business websites in 2026.

March 04, 2026Rutul Shah·9 min read

Web Design

Zero Trust Security: From Network Perimeter to Verify-Everything Architecture

Traditional security assumed your internal network was safe. Zero Trust assumes everything is hostile until proven otherwise. This shift from perimeter-based to verification-based security is becoming standard in 2026. Here's what it means for your organization.

April 27, 2026Marcus Lee·9 min read

Web Design

Preparing for Post-Quantum Cybersecurity: Why Harvest-Now-Decrypt-Later Attacks Matter Today

Harvest-now-decrypt-later attacks are a real threat: adversaries capture encrypted data today and decrypt it with quantum computers tomorrow. This isn't theoretical. The time to prepare for post-quantum cryptography is now.

April 13, 2026Marcus Lee·9 min read