CVE-2025-53770: Active exploitation targets SharePoint cryptographic keys

On July 19, 2025, Microsoft disclosed CVE-2025-53770, a critical zero-day remote code execution (RCE) vulnerability in SharePoint Server 2016, 2019, and the Subscription Edition, as well as unsupported 2010 and 2013 versions. The vulnerability carries a CVSS 3.1 base score of 9.8 (Critical) and stems from improper deserialization of untrusted data, allowing a remote, unauthenticated attacker to execute arbitrary code over the network without user interaction.

Cloudflare has released two emergency WAF Managed Rules to mitigate the vulnerability for customers using the Cloudflare Managed Ruleset. These rules were deployed on July 21, 2025, and take effect immediately.

The ToolShell exploit chain

What makes CVE-2025-53770 uniquely dangerous is the associated exploit chain, dubbed "ToolShell." Rather than simply gaining temporary access, attackers steal the server's cryptographic machine keys — specifically the ValidationKey and DecryptionKey. These keys allow threat actors to independently forge authentication tokens and __VIEWSTATE payloads, granting persistent access that survives standard mitigation measures such as server reboots or web shell removal.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-53770 to its Known Exploited Vulnerabilities (KEV) catalog with an emergency remediation deadline. Security researchers widely agree that any organization with an on-premise SharePoint server exposed to the Internet should assume compromise and act immediately.

The ToolShell chain was first demonstrated at the Pwn2Own competition in May 2025, where researchers chained an authentication bypass (CVE-2025-49706) with a deserialization RCE (CVE-2025-49704). Threat actors analyzed the subsequent patches to build in-the-wild bypasses, leading Microsoft to assign new identifiers — including CVE-2025-53771 for the authentication bypass. This rapid exploit-to-patch-to-bypass cycle highlights how adversaries systematically reverse-engineer patches to weaponize weaknesses, compressing the response window for defenders.

The exploit operates in three stages:

  1. Authentication bypass via CVE-2025-53771: The attack sends a POST request to the /_layouts/15/ToolPane.aspx endpoint — a legacy SharePoint component — with the Referer header set to /_layouts/SignOut.aspx. This tricks the server into trusting the attacker, skipping authentication checks.
  2. Remote code execution via CVE-2025-53770: With privileged access, the attacker submits a malicious payload in the request body. SharePoint deserializes the object into executable code on the server, giving the attacker arbitrary command execution.
  3. Key exfiltration for persistence: Using a web shell, the attacker steals ValidationKey and DecryptionKey, obtaining the state information SharePoint relies on. This yields an independent, permanent backdoor that operates long after the original exploit — enabling continued payload execution on the compromised server.

Since the emergency rules were deployed, Cloudflare has tracked HTTP request matches for the vulnerability. A significant peak was observed around 11AM UTC on July 22, reaching approximately 300,000 hits at one point.

A successful defense against this threat must address both the immediate RCE vector and the longer-term risk of persistent unauthorized access. Cloudflare's security analysts began researching the exploit on the evening of July 20, and crafted and tested patches covering both attack stages before deploying the emergency rules the following day.