Return to overview
0 min read

Eye Security Uncovers Actively Exploited Zero-Day in Microsoft SharePoint (CVE-2025-53770)

0 min read
July 21, 2025
By: Eye Security
SharePoint under siege
By: Eye Security
21 July 2025

On the evening of July 18, 2025, Eye Security identified active, large-scale exploitation of a new SharePoint remote code execution (RCE) vulnerability chain, dubbed ToolShell. This exploit is being used in the wild to compromise on-premise SharePoint servers across the world. The new chain we elaborate in this blog, was later named CVE-2025-53770 by Microsoft, as it is a variant of CVE-2025-49706.

Please find more details on our Tech Blog that's actively being maintained by our Research Team:

https://research.eye.security/sharepoint-under-siege/

Let's talk

Curious to know how we can help?

Get in touch
GET IN TOUCH
Share this article.