There is a good chance you opened it this morning before your second cup of coffee.
You clicked a shared folder, pulled up a document, maybe sent a link to a colleague. SharePoint is everywhere in corporate America, a background fixture so ordinary that most people never think about what is actually running underneath it.
That invisibility turned out to be a problem.
In July 2025, attackers discovered they could walk straight into an on-premises SharePoint server without a username or password, execute any code they wanted, and then move sideways across the rest of a company’s network.
The technique carried a name that had already been circulating inside the security community: ToolShell, coined at a hacking competition two months earlier, and now being weaponized for real.
The software that quietly runs your workday is older than most people think
SharePoint Server has been the backbone of corporate document management for more than two decades.
It is a collaboration and content management platform, commonly hosted on Windows Server virtual machines in corporate data centers or cloud infrastructure, letting teams store documents, build internal sites and workflows, and integrate tightly with Active Directory and Microsoft 365 tools.
Most employees interact with it through a browser tab that looks like any other file manager. The server underneath handles authentication, permissions, and data parsing entirely out of sight.
That hidden machinery is exactly where the attackers went to work.
A patch arrived and the attackers immediately went looking for the back door
The ToolShell story actually started before any patches existed. At Pwn2Own Berlin 2025, a researcher from Viettel Cyber Security combined an authentication bypass and an insecure deserialization bug to exploit Microsoft SharePoint. That demonstration took place on May 16, 2025. The Pwn2Own exploit chain from May 2025 was dubbed “ToolShell,” taking its name from the ToolPane.aspx endpoint at the heart of the attack.
Both ToolShell vulnerabilities are bypass variants of previously patched vulnerabilities, CVE-2025-49704 (the original RCE) and CVE-2025-49706 (the original spoofing flaw). The chain bypasses weaknesses Microsoft thought it had closed in the July 9, 2025 Patch Tuesday rollout.
The new ToolShell vulnerabilities were an evolution of those earlier, partially mitigated flaws, highlighting a crucial aspect of modern cyber threats: the continuous cat-and-mouse game between defenders and attackers, where incomplete remediations can lead to more sophisticated bypasses.
On July 14, 2025, cybersecurity firm Code White reproduced the exploit, validating that the chain could still be leveraged. July 18, 2025 saw the first confirmed in-the-wild attacks, as threat actors had developed bypass variants that sidestepped the July 9 patches and began exploiting vulnerable SharePoint servers.
When chained together, those techniques enabled fully unauthenticated remote code execution. No stolen credentials required. No phishing email. No insider help.
State-backed groups were already inside before most teams had read the alert
Microsoft Threat Intelligence confirmed that the groups behind these attacks include Linen Typhoon and Violet Typhoon, two China-based advanced persistent threat groups, and Storm-2603, another China-based threat actor whose motivations and identity remain unclear. Linen Typhoon, also known as APT27, is a Chinese state-backed actor active since at least 2010. Violet Typhoon is also known as APT31. Microsoft has observed Storm-2603 deploying Warlock and LockBit ransomware, though the company has not yet been able to confidently assess the actor’s ultimate objectives.
Just as concerning as the actors was the speed. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog on July 20, 2025, one day after Microsoft’s Security Response Center published its advisory on July 19, a sign that real-world exploitation was already well underway before the public even knew the full scope of the flaw.
For more on how state-sponsored groups exploit software gaps before patches land, see GCN’s earlier report on North Korea’s Lazarus Group and a Windows zero-day.
According to security firm Orca, 13 percent of cloud environments run vulnerable self-hosted SharePoint components, and 6 percent expose them directly to the internet, making them immediate targets for exploitation.
Here is the two-step trick that handed hackers full control of a server they had never logged into
This is the part most news reports skipped, but it is the part that actually explains how serious ToolShell was.
The attack chain uses two flaws in sequence. First, the attacker sends a specially crafted HTTP POST request to the SharePoint endpoint /_layouts/15/ToolPane.aspx. These requests include a forged Referer header, such as /_layouts/SignOut.aspx, which tricks SharePoint into processing the malicious payload as if it were a legitimate, authenticated request, bypassing authentication mechanisms.
SharePoint’s code checks that header to decide whether a request is legitimate. A forged header is enough to fool it. That gets the attacker past the front door.
Now comes the second step. SharePoint mistakenly deserializes user-controlled data and executes it as code on the server, the crux of CVE-2025-53770, allowing the attacker to run arbitrary code in the SharePoint application context.
Think of deserialization as a process where the server unpacks a data package sent by a user and trusts that its contents are safe. They were not safe.
CVE-2025-53770 is especially dangerous because it allows for remote code execution, meaning attackers can run any command or program on the vulnerable server without logging in, giving them full control, including the ability to access files, change configurations, and move laterally throughout the network.
The attacker goes from a blank browser to owning the server in two requests. With a CVSS score of 9.8, it represents a SharePoint remote code execution risk of the highest severity.
Emergency patches are out, but the cleanup story is only beginning
Microsoft released emergency security updates for all supported on-premises versions of SharePoint, including SharePoint Server 2016, 2019, and Subscription Edition, closing the critical remote code execution and path traversal flaws linked to the ToolShell exploit chain.
Critically, SharePoint Online in Microsoft 365 is not impacted by the zero-day, meaning organizations running the cloud-managed version were never exposed.
But patching is not the end of the story. Patching alone does not guarantee a SharePoint environment is secure if attackers had already breached it prior to patching.
Security teams are advised to rotate machine keys and enable AMSI integration with Defender Antivirus to prevent further exploitation. Auditing for web shells planted before the fix arrived remains equally urgent.
ToolShell is a clean example of a pattern that keeps repeating across enterprise software: the familiar tool running quietly in the background carries a hidden attack surface that almost nobody thinks about until a nation-state group does.
If your organization still runs SharePoint on its own servers, the two-step trick described above is exactly why that distinction matters more than most IT discussions let on.
