{"id":11465,"date":"2025-07-21T12:34:20","date_gmt":"2025-07-21T05:34:20","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=11465"},"modified":"2026-06-25T09:59:57","modified_gmt":"2026-06-25T02:59:57","slug":"sharepoint-server-caught-zero-day-multiple-systems-controlled-by-remote-hackers","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/en\/2025\/07\/21\/sharepoint-server-caught-zero-day-multiple-systems-controlled-by-remote-hackers\/","title":{"rendered":"SharePoint Server Caught Zero-Day, Multiple Systems Controlled by Remote Hackers"},"content":{"rendered":"
A zero-day vulnerability (CVE-2025-53770) was recently discovered in Microsoft SharePoint Server. The vulnerability is being exploited on a large scale out of practice, affecting dozens of organizations, including multinational corporations and government agencies. This is a highly technical attack that can be difficult to detect and can have serious consequences if not addressed in a timely manner. <\/b>
\n\u200b<\/div>\n
\n
\"1753087329043.png\"<\/div>\n<\/div>\n
\n

The CVE-2025-53770 vulnerability is an upgraded variant of the CVC-49704 vulnerability (which was patched by Microsoft in early July). However, the previous patch was not thorough and was found to be surpassed by hacking groups.<\/p>\n

CVE-2025-53770 exploits an error during the “deserialization” process, when SharePoint handles external input data without full authentication. This allows hackers to execute arbitrary code remotely without login (unauthenticated RCE).<\/p>\n

The company also revealed another vulnerability, CVE-2025-53771, which it said had more protections than CV E-2 025 – 49706. This revealed two new zero-day vulnerabilities, both of which passed Microsoft’s initial bug fixes earlier this month.<\/p>\n

The attack process goes in extremely delicate direction:<\/p>\n<\/div>\n