Microsoft Rushes Emergency SharePoint Patches as New Zero-Days Fuel ToolShell Attacks

Two new zero-day vulnerabilities in Microsoft SharePoint are being actively exploited by threat actors to compromise organizations worldwide, prompting the company to issue urgent out-of-band patches.

New Exploits Bypass July’s Security Fixes

Microsoft has confirmed that attackers are leveraging CVE-2025-53770 and CVE-2025-53771, two previously unknown flaws that bypass earlier patches released in July for the infamous “ToolShell” exploit chain.

While the company addressed the original ToolShell vulnerabilities—CVE-2025-49704 and CVE-2025-49706—during Patch Tuesday, threat actors rapidly adapted, developing new techniques to bypass those fixes and resume remote code execution (RCE) attacks on on-premise SharePoint servers.

Microsoft notes that SharePoint Online customers are not impacted by these attacks.

Exploitation Already Underway

Security firm Eye Security first observed the new wave of attacks on July 18, after detecting a suspicious .aspx file execution on a client’s server. Investigations revealed attackers were uploading a malicious file named spinstall0.aspx to harvest machine keys and execute arbitrary commands.

Microsoft confirmed that over 85 servers had been compromised by the time the emergency updates were issued, and that 54 organizations have been impacted, including major corporations and U.S. government agencies.

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

Emergency Updates Issued for SharePoint

In response to the widespread exploitation, Microsoft has released emergency security updates for the following SharePoint versions:

• KB5002754 for SharePoint Server 2019
• KB5002768 for SharePoint Subscription Edition

The update for SharePoint Server 2016 is still in development.

Microsoft confirmed that these new patches offer more robust protections than the original July fixes and are designed to fully close the bypass vulnerabilities.

Mitigations and Key Rotation Urged

Admins are urged to rotate SharePoint machine keys after applying updates. This can be done via PowerShell using the Update-SPMachineKey cmdlet or through Central Administration by triggering the “Machine Key Rotation Job.”

Additionally, Microsoft recommends:

• Enabling AMSI integration (Antimalware Scan Interface) in SharePoint
• Deploying Microsoft Defender Antivirus on all SharePoint servers
• Temporarily disconnecting unpatched SharePoint servers from the internet

These steps are expected to help block unauthenticated exploitation attempts.

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: bleepingcomputer.com

Source Link