Microsoft has recently issued an urgent security alert concerning active cyberattacks targeting on-premises SharePoint servers. These attacks exploit a previously unknown vulnerability, designated as CVE-2025-53770, which allows unauthorized remote code execution on affected systems. The vulnerability does not impact SharePoint Online services within Microsoft 365. (msrc.microsoft.com)
The exploitation of CVE-2025-53770 has been observed since at least July 18, 2025. Attackers are leveraging this flaw to deploy malicious ASPX payloads, such as "spinstall0.aspx," which extract cryptographic machine keys from SharePoint servers. Possession of these keys enables attackers to forge valid ViewState tokens, granting persistent, unauthenticated access to compromised systems. (research.eye.security)
In response, Microsoft has provided interim mitigation measures, as a security patch is not yet available. Administrators are advised to enable Antimalware Scan Interface (AMSI) integration in SharePoint and deploy Microsoft Defender Antivirus across all SharePoint servers. If enabling AMSI is not feasible, disconnecting the server from the internet is recommended until a security update is released. (msrc.microsoft.com)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also issued guidance on this vulnerability, emphasizing the importance of implementing Microsoft's recommended mitigations promptly. Organizations are urged to monitor for specific indicators of compromise, such as POST requests to
/_layouts/15/ToolPane.aspx?DisplayMode=Edit and scanning for certain IP addresses associated with the attacks. (cisa.gov)Given the severity of this vulnerability, with a CVSS score of 9.8, organizations utilizing on-premises SharePoint servers should act immediately to implement the recommended mitigations and monitor their systems for signs of compromise. Staying informed through official channels and applying security updates as they become available is crucial to safeguarding against these active threats.
Source: Profit by Pakistan Today Microsoft warns of active attacks on server software
