Is CVE-2025-53770 actively exploited?

Yes. CVE-2025-53770 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2025-53770 be exploited remotely?

The attack vector of CVE-2025-53770 has not been classified yet.

What is the CVSS score of CVE-2025-53770?

CVE-2025-53770 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2025-53770

HIGHCISA KEVIN THE WILD

CVE-2025-53770

Published: July 20, 2025

EPSS:90.95%probability of exploitation in 30 daysPercentile:99.6th

Official Description

Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

NVD Source

CISA KEV Advisory

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Added to KEV: 2025-07-20Federal patch deadline: 2025-07-21⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Risk Analysis

Microsoft SharePoint Server on-premises is vulnerable to deserialization of untrusted data, which could allow an unauthorized attacker to execute code over a network. This high-severity flaw is a patch bypass for CVE-2025-49704 and has a very high exploitation likelihood (EPSS 0.90947). It is in CISA's KEV, confirming active exploitation.

This vulnerability is actively exploited in the wild and can be chained with CVE-2025-53771. Attackers can execute code remotely without authorization.

Recommended Action

Apply the security updates for Microsoft SharePoint Server that address CVE-2025-53770, as these provide more robust protection. Ensure SharePoint servers are properly segmented and secured.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-53770 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2025-53770 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.