CVE-2025-53770 Microsoft SharePoint Deserialization of Untrusted Data

Exploited in the wild Critical 9.8 Published 20 Jul 2025 Updated 4 Aug 2026

Unauthorized attackers can execute code remotely via deserialization in Microsoft SharePoint Server, requiring immediate mitigation and patching.

Exploited in the wild: Since 20 Jul 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-53770?

CVE-2025-53770 is a critical unsafe deserialization vulnerability in Microsoft Sharepoint Server, published on 20 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Weakness: CWE-502

Which versions are affected by CVE-2025-53770?

It affects 1 product.

Products include Microsoft Sharepoint Server.

How do I fix CVE-2025-53770?

No fix has been published for CVE-2025-53770 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Jul 2025.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2025-53770 being exploited?

Yes. Attackers have exploited CVE-2025-53770 in the wild since at least 20 Jul 2025, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 45 proofs of concept on GitHub.

All Microsoft Sharepoint Server vulnerabilities

Sources

Also known as GHSA-xcrc-8vqv-vc8r.