Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since July 20, 2025.
CVE-2025-53770
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Added to KEV July 20, 2025
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2025-53770
- CWE
- CWE-502
- Affected products
- SharePoint · Microsoft SharePoint · Microsoft
What happened
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
What it means for your business
Microsoft SharePoint is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2025-53770). Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704. CISA remediation due date: 2025-07-21. If you need help checking exposure, call (864) 335-9223.
Required action
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
CISA due date: July 21, 2025
Sources
Related briefs
Microsoft SharePoint Weak Authentication Vulnerability
Microsoft SharePoint is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-55040). Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. CISA remediation due date: 2026-08-21. If you need help checking exposure, call (864) 335-9223.
Microsoft PowerShell Security Feature Bypass vulnerability
Microsoft PowerShell Security Feature Bypass vulnerability (CVE-2026-70338) was added to Microsoft’s security update guidance. Acknowledgement Updated If you need help checking exposure, call (864) 335-9223.
Microsoft Windows Cross Device Service Elevation of Privilege vulnerability
Microsoft Windows Cross Device Service Elevation of Privilege vulnerability (CVE-2026-66804) was added to Microsoft’s security update guidance. Acknowledgement Updated If you need help checking exposure, call (864) 335-9223.
Windows iSCSI Target Service Remote Code Execution vulnerability
Windows iSCSI Target Service Remote Code Execution vulnerability (CVE-2026-65791) was added to Microsoft’s security update guidance. Acknowledgement Updated If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.