On the evening of July 18, 2025, Eye Security identified active, large-scale exploitation of a new SharePoint remote code execution (RCE) vulnerability chain, dubbed ToolShell. This exploit is being used in the wild to compromise on-premise SharePoint servers across the world. The new chain we elaborate in this blog, was later named CVE-2025-53770 by Microsoft, as it is a variant of CVE-2025-49706.
Please find more details on our Tech Blog that's actively being maintained by our Research Team: