---
title: "ToolShell: SharePoint On-Prem Unauthenticated RCE Chain"
url: https://erroneo.us/security/briefs/toolshell-sharepoint-cve-2025-53770/
description: "ToolShell (CVE-2025-53770/53771, built on CVE-2025-49704/49706) hit on-prem SharePoint 2016/2019/SE in July 2025. Patched; rotate machine keys and hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-07-19
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-53770", "CVE-2025-53771", "CVE-2025-49704", "CVE-2025-49706"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ToolShell: SharePoint On-Prem Unauthenticated RCE Chain

**Verdict: Check exposure.** Fixes shipped in July 2025, but ToolShell stole ASP.NET machine keys that survive patching, so any on-prem SharePoint that was internet-facing then needs proof that keys were rotated and no backdoor remains.

- **Who must act:** Owners of on-premises SharePoint Server 2016, 2019 or Subscription Edition, and anyone still running end-of-life SharePoint 2013 or older.
- **Who can relax:** SharePoint Online (Microsoft 365) customers, who were not affected, and on-prem farms that patched, rotated machine keys and ran a hunt in 2025.
- **Affected:** SharePoint Server Subscription Edition before 16.0.18526.20508; SharePoint Server 2019 before 16.0.10417.20037; SharePoint Enterprise Server 2016 before 16.0.5513.1001; SharePoint Server 2013 and earlier (end of life, no fix)
- **Fixed:** Subscription Edition KB5002768 (16.0.18526.20508); SharePoint 2019 KB5002754 + language pack KB5002753 (16.0.10417.20037); SharePoint 2016 KB5002760 + language pack KB5002759 (16.0.5513.1001)
- **CVEs:** CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm every SharePoint server is on the July 2025 comprehensive update or later (check the farm build in Central Administration)
2. Enable AMSI integration in Full Mode and run antivirus/EDR on all SharePoint servers
3. Rotate ASP.NET machine keys with Set-SPMachineKey or the Machine Key Rotation Job, then run iisreset.exe on every server
4. Remove unknown module entries from web.config and applicationHost.config before restarting IIS
5. Disconnect SharePoint 2013 and older from the internet

### How to check if you are affected

- Search the LAYOUTS directory for spinstall0.aspx and variants (spinstall.aspx, spinstall1.aspx, spinstall2.aspx)
- Search IIS logs for POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit with referrer /_layouts/SignOut.aspx
- Look for w3wp.exe spawning cmd.exe or powershell.exe with base64-encoded commands
- Check July 2025 logs for the IPs 107.191.58[.]76, 104.238.159[.]149 and 96.9.125[.]147

## What happened

On the evening of July 18, 2025 (UTC), [Eye Security](https://labs.eye.security/sharepoint-under-siege/) found mass exploitation of on-premises SharePoint servers. Attackers sent a forged request to `/_layouts/15/ToolPane.aspx` and got remote code execution without logging in. The first thing they did was drop a small page, `spinstall0.aspx`, whose only job was to return the server's ASP.NET `ValidationKey` and `DecryptionKey`. With those keys, an attacker can sign malicious `__VIEWSTATE` payloads and get back in even after the server is patched.

The chain, nicknamed "ToolShell," grew out of two bugs that CODE WHITE showed at Pwn2Own Berlin in May 2025. They are [CVE-2025-49706](https://cveawg.mitre.org/api/cve/CVE-2025-49706) (authentication bypass, CVSS 6.5) and [CVE-2025-49704](https://cveawg.mitre.org/api/cve/CVE-2025-49704) (code injection, CVSS 8.8), both patched on July 8. On July 19, Microsoft issued guidance for [CVE-2025-53770](https://cveawg.mitre.org/api/cve/CVE-2025-53770), an unauthenticated deserialization RCE rated CVSS 9.8. It was followed by [CVE-2025-53771](https://cveawg.mitre.org/api/cve/CVE-2025-53771) (CVSS 6.5). These are bypasses of the July 8 fixes.

Within days, [Microsoft](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/) attributed exploitation to the Chinese state actors Linen Typhoon and Violet Typhoon, and to Storm-2603, which deployed Warlock ransomware starting July 18. Microsoft saw exploitation attempts as early as July 7.

## Who is affected

Only on-premises SharePoint Server Subscription Edition, 2019 and 2016 are covered by these fixes. SharePoint Online in Microsoft 365 was not affected. The fixed builds are 16.0.18526.20508 for Subscription Edition (KB5002768), 16.0.10417.20037 for 2019 (KB5002754 plus language pack KB5002753), and 16.0.5513.1001 for 2016 (KB5002760 plus KB5002759). [CISA](https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities) says SharePoint 2013 and older is end of life and should be disconnected from the internet.

## Do you really need to act?

If your farm was patched and keys were rotated in July 2025, you probably don't need to do anything more. If you only installed the update, you may still have a problem. Patching closes the hole, but stolen machine keys keep working until you rotate them. Eye scanned more than 23,000 SharePoint servers and found over 400 compromised, with more than 8,000 still exposed when it last updated its post. Unrotated keys and leftover IIS modules are the realistic risk in October 2026.

Sources disagree on which CVE was exploited first. KEV lists CVE-2025-53770 (added July 20), and its CVE record says an exploit "exists in the wild." CISA's later alert text calls CVE-2025-53770 and 53771 patch bypasses that were not being exploited. Eye's July 29 correction attributes the July 17 to 19 waves to the original CVE-2025-49706/49704 chain against servers that had not installed the July 8 fix. For defenders the conclusion is the same: every supported version needs the comprehensive July update, and the farm needs fresh keys. The verdict is **check-exposure**. If you never rotated keys on a farm that was internet-facing, treat it as act-now.

## What to do now

1. Confirm the farm build is at or above the fixed builds listed above. In PowerShell, `(Get-SPFarm).BuildVersion` shows it.
2. Enable AMSI integration in Full Mode and run Defender or another EDR on every SharePoint server. Microsoft says to take the server off the internet if you cannot.
3. Rotate machine keys with `Set-SPMachineKey` (or the Machine Key Rotation Job), then run `iisreset.exe` on all servers.
4. Before that restart, remove unknown module entries from `web.config` and `applicationHost.config`. CISA warns they otherwise reload.
5. Retire or isolate SharePoint 2013 and older.

## How to tell if you were hit

Look in the `LAYOUTS` directory for `spinstall0.aspx`, `spinstall.aspx`, `spinstall1.aspx` or `spinstall2.aspx`. Search IIS logs for `POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit` with a `/_layouts/SignOut.aspx` referrer. In EDR data, look for `w3wp.exe` spawning `cmd.exe` and PowerShell with base64 payloads. Microsoft lists Storm-2603 artifacts, including `IIS_Server_dll.dll`, `debug_dev.js` and `xd.exe`. CISA names the IPs `107.191.58[.]76`, `104.238.159[.]149` and `96.9.125[.]147` for July 18 and 19.

## Timeline

- May 2025 — CODE WHITE demonstrates the chain at Pwn2Own Berlin.
- Jul 7, 2025 — Earliest exploitation attempts seen by Microsoft.
- Jul 8, 2025 — Patches for CVE-2025-49704 and CVE-2025-49706.
- Jul 18, 2025 — Eye Security detects the first mass-exploitation wave (18:06 UTC).
- Jul 19, 2025 — Microsoft guidance for CVE-2025-53770.
- Jul 20, 2025 — CVE-2025-53770 added to KEV; CVE-2025-53771 published.
- Jul 22, 2025 — Microsoft names the threat actors; CVE-2025-49704/49706 added to KEV.

## Sources

1. [CVE Program — CVE-2025-53770 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-53770)
2. [CVE Program — CVE-2025-53771 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-53771)
3. [CVE Program — CVE-2025-49704 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-49704)
4. [CVE Program — CVE-2025-49706 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-49706)
5. [Microsoft Security Blog — Disrupting active exploitation of on-premises SharePoint vulnerabilities](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/)
6. [CISA — Microsoft releases guidance on exploitation of SharePoint vulnerabilities](https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities)
7. [Eye Security — SharePoint under siege](https://labs.eye.security/sharepoint-under-siege/)

---
Source page: https://erroneo.us/security/briefs/toolshell-sharepoint-cve-2025-53770/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt