tag
APT31
CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706
web
CRITICAL
KEV
Ransomware
EPSS 100%
ToolShell - SharePoint Unauthenticated RCE Chain
CVE-2025-53770 ("ToolShell") is a full unauthenticated remote code execution chain against Microsoft SharePoint Server. The chain combines an authentication bypass in the ToolPane.aspx endpoint (CVE-2025-49706 / patch bypass CVE-2025-53771) with an unsafe…
Patched
2026-05-17