ToolShell: SharePoint On-Prem Unauthenticated RCE Chain

What to do

1. Confirm every SharePoint server is on the July 2025 comprehensive update or later (check the farm build in Central Administration)
2. Enable AMSI integration in Full Mode and run antivirus/EDR on all SharePoint servers
3. Rotate ASP.NET machine keys with Set-SPMachineKey or the Machine Key Rotation Job, then run iisreset.exe on every server
4. Remove unknown module entries from web.config and applicationHost.config before restarting IIS
5. Disconnect SharePoint 2013 and older from the internet

How to check if you are affected or compromised

• Search the LAYOUTS directory for spinstall0.aspx and variants (spinstall.aspx, spinstall1.aspx, spinstall2.aspx)
• Search IIS logs for POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit with referrer /_layouts/SignOut.aspx
• Look for w3wp.exe spawning cmd.exe or powershell.exe with base64-encoded commands
• Check July 2025 logs for the IPs 107.191.58[.]76, 104.238.159[.]149 and 96.9.125[.]147

What happened#

On the evening of July 18, 2025 (UTC), Eye Security found mass exploitation of on-premises SharePoint servers. Attackers sent a forged request to /_layouts/15/ToolPane.aspx and got remote code execution without logging in. The first thing they did was drop a small page, spinstall0.aspx, whose only job was to return the server's ASP.NET ValidationKey and DecryptionKey. With those keys, an attacker can sign malicious __VIEWSTATE payloads and get back in even after the server is patched.

The chain, nicknamed "ToolShell," grew out of two bugs that CODE WHITE showed at Pwn2Own Berlin in May 2025. They are CVE-2025-49706 (authentication bypass, CVSS 6.5) and CVE-2025-49704 (code injection, CVSS 8.8), both patched on July 8. On July 19, Microsoft issued guidance for CVE-2025-53770, an unauthenticated deserialization RCE rated CVSS 9.8. It was followed by CVE-2025-53771 (CVSS 6.5). These are bypasses of the July 8 fixes.

Within days, Microsoft attributed exploitation to the Chinese state actors Linen Typhoon and Violet Typhoon, and to Storm-2603, which deployed Warlock ransomware starting July 18. Microsoft saw exploitation attempts as early as July 7.

Who is affected#

Only on-premises SharePoint Server Subscription Edition, 2019 and 2016 are covered by these fixes. SharePoint Online in Microsoft 365 was not affected. The fixed builds are 16.0.18526.20508 for Subscription Edition (KB5002768), 16.0.10417.20037 for 2019 (KB5002754 plus language pack KB5002753), and 16.0.5513.1001 for 2016 (KB5002760 plus KB5002759). CISA says SharePoint 2013 and older is end of life and should be disconnected from the internet.

Do you really need to act?#

If your farm was patched and keys were rotated in July 2025, you probably don't need to do anything more. If you only installed the update, you may still have a problem. Patching closes the hole, but stolen machine keys keep working until you rotate them. Eye scanned more than 23,000 SharePoint servers and found over 400 compromised, with more than 8,000 still exposed when it last updated its post. Unrotated keys and leftover IIS modules are the realistic risk in October 2026.

Sources disagree on which CVE was exploited first. KEV lists CVE-2025-53770 (added July 20), and its CVE record says an exploit "exists in the wild." CISA's later alert text calls CVE-2025-53770 and 53771 patch bypasses that were not being exploited. Eye's July 29 correction attributes the July 17 to 19 waves to the original CVE-2025-49706/49704 chain against servers that had not installed the July 8 fix. For defenders the conclusion is the same: every supported version needs the comprehensive July update, and the farm needs fresh keys. The verdict is check-exposure. If you never rotated keys on a farm that was internet-facing, treat it as act-now.

What to do now#

1. Confirm the farm build is at or above the fixed builds listed above. In PowerShell, (Get-SPFarm).BuildVersion shows it.
2. Enable AMSI integration in Full Mode and run Defender or another EDR on every SharePoint server. Microsoft says to take the server off the internet if you cannot.
3. Rotate machine keys with Set-SPMachineKey (or the Machine Key Rotation Job), then run iisreset.exe on all servers.
4. Before that restart, remove unknown module entries from web.config and applicationHost.config. CISA warns they otherwise reload.
5. Retire or isolate SharePoint 2013 and older.

How to tell if you were hit#

Look in the LAYOUTS directory for spinstall0.aspx, spinstall.aspx, spinstall1.aspx or spinstall2.aspx. Search IIS logs for POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit with a /_layouts/SignOut.aspx referrer. In EDR data, look for w3wp.exe spawning cmd.exe and PowerShell with base64 payloads. Microsoft lists Storm-2603 artifacts, including IIS_Server_dll.dll, debug_dev.js and xd.exe. CISA names the IPs 107.191.58[.]76, 104.238.159[.]149 and 96.9.125[.]147 for July 18 and 19.

Timeline#

• May 2025 — CODE WHITE demonstrates the chain at Pwn2Own Berlin.
• Jul 7, 2025 — Earliest exploitation attempts seen by Microsoft.
• Jul 8, 2025 — Patches for CVE-2025-49704 and CVE-2025-49706.
• Jul 18, 2025 — Eye Security detects the first mass-exploitation wave (18:06 UTC).
• Jul 19, 2025 — Microsoft guidance for CVE-2025-53770.
• Jul 20, 2025 — CVE-2025-53770 added to KEV; CVE-2025-53771 published.
• Jul 22, 2025 — Microsoft names the threat actors; CVE-2025-49704/49706 added to KEV.

Vulnerability records

• CVE-2025-53770 · KEV 2025-07-20 · Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
• CVE-2025-53771 · Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-49704 · KEV 2025-07-22 · Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2025-49706 · KEV 2025-07-22 · Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE Program — CVE-2025-53770 record (JSON) cveawg.mitre.org
2. CVE Program — CVE-2025-53771 record (JSON) cveawg.mitre.org
3. CVE Program — CVE-2025-49704 record (JSON) cveawg.mitre.org
4. CVE Program — CVE-2025-49706 record (JSON) cveawg.mitre.org
5. Microsoft Security Blog — Disrupting active exploitation of on-premises SharePoint vulnerabilities microsoft.com
6. CISA — Microsoft releases guidance on exploitation of SharePoint vulnerabilities cisa.gov
7. Eye Security — SharePoint under siege labs.eye.security