Microsoft SharePoint Application Package RCE Vulnerability
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
Techniques marked “observed” are corroborated by threat intelligence; the rest are inferred from the weakness type (CWE) and attack vector.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Groups documented using the techniques observed against this CVE — a tradecraft association, not a confirmed attribution. Overlap count shown; click for the MITRE profile.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Restrict network access to SharePoint servers from untrusted sources, ideally placing them behind firewalls with strict access control lists. Implement robust monitoring for unusual process execution, unexpected file modifications, and suspicious network traffic originating from SharePoint servers. Consider deploying a Web Application Firewall (WAF) to filter malicious requests targeting SharePoint web applications.
The permanent resolution is to apply the security updates released by Microsoft for all affected versions of SharePoint Server. Administrators should prioritize deploying these patches promptly to eliminate the vulnerability. Ensure all SharePoint servers are updated to the latest secure build recommended by Microsoft.
An unauthenticated attacker can execute arbitrary code with elevated privileges on the SharePoint server. This can lead to full server compromise, allowing data exfiltration, service disruption, and the ability to pivot to other systems within the network. The business consequences include significant data breaches, reputational damage, and operational downtime.
Other CVEs affecting sharepoint enterprise server
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.