CVE-2025-53770CriticalCVSS 9.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
🔗 CVE IDs covered (1)
📋 Description
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
🎯 Affected products3
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server Subscription Edition
✅ Remediation
KB5002760 (Security Update) — fixed build 16.0.5513.1001 KB5002759 (Security Update) — fixed build 16.0.5513.1001 KB5002754 (Security Update) — fixed build 16.0.10417.20037 KB5002753 (Security Update) — fixed build 16.0.10417.20037 KB5002768 (Security Update) — fixed build 16.0.18526.20508
🔗 References (9)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108288
- referencehttps://support.microsoft.com/help/5002760
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108289
- referencehttps://support.microsoft.com/help/5002759
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108286
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108287
- referencehttps://support.microsoft.com/help/5002753
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108285