DaystoPatch

MicrosoftExploited incident

SharePoint Server 'ToolShell': July 8 fixes incomplete, full fixes July 20-21, 2025 (CVE-2025-53770, -53771, -49704, -49706)

CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 20 Jul 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version 13 days after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
12d
First public report to first fix
Follow-through
13d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE-2025-49704 record (CNA: Microsoft)CuratedQuote verified

    "datePublished":"2025-07-08T16:58:05.908Z"

    July 2025 Patch Tuesday disclosure of the original ToolShell pair (CVE-2025-49704 RCE, CVSS 8.8; CVE-2025-49706 spoofing, CVSS 6.5, record 16:58:07Z) with updates that Microsoft later said only 'partially addressed' the bugs (R1, see notes).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fb32ffdc2cc77ac8…
    Used in metrics
    Yes
    Dispute this timestamp
    9 more sources for this moment
    Microsoft advisory CVE-2025-49704ClaimedQuote not found in archive8 Jul 2025

    Microsoft SharePoint Remote Code Execution Vulnerability. Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over

    The vendor's own disclosure.

    Source
    Microsoft advisory CVE-2025-49704 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:dbb91eba684c6ebf…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-49704ClaimedQuote verified8 Jul 2025, 16:58 UTC

    Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fb32ffdc2cc77ac8…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet8 Jul 2025, 17:03 UTC

    You can now share your thoughts on vulnerability CVE-2025-49706 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Eye Security: SharePoint Under Siege (Wayback capture 2025-07-19 08:33 UTC)CuratedQuote verified19 Jul 2025

    On the evening of July 18, 2025

    Capture of 2025-07-19 08:33 UTC; post dated 'Jul 19, 2025': 'On the evening of July 18, 2025, Eye Security identified active, large-scale exploitation of a new SharePoint remote code execution (RCE) vulnerability chain, dubbed ToolShell'. The live page now redirects to labs.eye.security, which robots.txt blocks, so the capture is cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3659ce474e0bb908…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-53770)ClaimedQuote verified20 Jul 2025

    Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

    Added to CISA's KEV catalog on 2025-07-20.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet20 Jul 2025, 07:09 UTC

    Customer guidance for SharePoint vulnerability CVE-2025-53770

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet20 Jul 2025, 12:30 UTC

    📢 Vulnérabilité critique dans SharePoint Server exploitée massivement 📝 Selon un article publié sur Forbes, Microsoft a confirmé une **vulnérabilité critique** dans **Sh... 📖 cyberveille : https://

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-49704)ClaimedQuote verified22 Jul 2025

    Microsoft SharePoint Code Injection Vulnerability

    Added to CISA's KEV catalog on 2025-07-22.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-49706)ClaimedQuote verified22 Jul 2025

    Microsoft SharePoint Improper Authentication Vulnerability

    Added to CISA's KEV catalog on 2025-07-22.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE-2025-49704 record (CNA: Microsoft)CuratedQuote verified

    "datePublished":"2025-07-08T16:58:05.908Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fb32ffdc2cc77ac8…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Microsoft advisory CVE-2025-49704ClaimedQuote not found in archive8 Jul 2025

    Microsoft SharePoint Remote Code Execution Vulnerability. Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over

    Source
    Microsoft advisory CVE-2025-49704 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:dbb91eba684c6ebf…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Microsoft advisory CVE-2025-49706ClaimedQuote verified8 Jul 2025

    Information published.

    revision 1.0 (first entry in the CVE's revision history)

    Source
    Microsoft advisory CVE-2025-49706 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Microsoft advisory CVE-2025-53770ClaimedQuote verified19 Jul 2025

    Information published.

    revision 1.0 (first entry in the CVE's revision history)

    Source
    Microsoft advisory CVE-2025-53770 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    MSRC blog: Customer guidance for SharePoint vulnerability CVE-2025-53770 (Wayback capture 2025-08-05)CuratedQuote verified19 Jul 2025

    Information published 07/19/25

    First public acknowledgement of active exploitation: 'Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update.' MSRC dates are Pacific; the CVE-2025-53770 record itself is dated 2025-07-20T01:06:33Z (UTC).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0365e16d2d87cf72…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Microsoft advisory CVE-2025-53771ClaimedQuote verified20 Jul 2025

    Information published.

    revision 1.0 (first entry in the CVE's revision history)

    Source
    Microsoft advisory CVE-2025-53771 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE-2025-53770 record (CNA: Microsoft)CuratedQuote verified20 Jul 2025, 01:06 UTC

    "datePublished":"2025-07-20T01:06:33.607Z"

    CVE-2025-53771 followed at 2025-07-20T22:16:52Z (CVSS 6.5).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2fc5a3890810a19c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date only+11d

    MSRC blog: Customer guidance for SharePoint vulnerability CVE-2025-53770 (Wayback capture 2025-08-05)CuratedQuote verified

    Ensure the Antimalware Scan Interface (AMSI) is turned on and configured correctly, with an appropriate antivirus solution such as Defender Antivirus

    Mitigation in the first version of the guidance (revision 1.0, 07/19/25 Pacific), with the fallback of disconnecting servers from the internet.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0365e16d2d87cf72…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Microsoft advisory CVE-2025-53770ClaimedQuote verified19 Jul 2025

    The following mitigating factors might be helpful in your situation: Customers who have enabled the AMSI integration feature and use Microsoft Defender across their SharePoint Server farm(s) are protected from this vulnerability.

    Workaround/Mitigation remediation listed; dated by the first revision

    Source
    Microsoft advisory CVE-2025-53770 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  4. First fix

    date only+12d

    MSRC CVRF document 2025-Jul (CVE-2025-53770 entry)CuratedQuote verified

    Updates are now available for Microsoft SharePoint Server Subscription Edition and Microsoft SharePoint Server 2019.

    First complete fix (R1). The CVE FAQ entry is headed '7/20/2025 Update:'; CVRF revisions 2.0/3.0 are dated 2025-07-20 (Pacific date). The KBs (KB5002768 SE, KB5002754 2019) are titled 'July 21, 2025', so the UTC date may be 2025-07-21.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    Microsoft advisory CVE-2025-49704ClaimedQuote verified8 Jul 2025

    Information published.

    Vendor Fix listed at the first revision

    Source
    Microsoft advisory CVE-2025-49704 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Microsoft advisory CVE-2025-49706ClaimedQuote verified8 Jul 2025

    Information published.

    Vendor Fix listed at the first revision

    Source
    Microsoft advisory CVE-2025-49706 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Microsoft advisory CVE-2025-53770ClaimedQuote verified20 Jul 2025

    The security update is available for Microsoft SharePoint Server Subscription Edition.

    revision 2.0

    Source
    Microsoft advisory CVE-2025-53770 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Microsoft advisory CVE-2025-53771ClaimedQuote verified20 Jul 2025

    The security update is available for Microsoft SharePoint Server 2019.

    revision 2.0

    Source
    Microsoft advisory CVE-2025-53771 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date only+13d

    Microsoft Support KB5002760CuratedQuote verified

    Description of the security update for SharePoint Server 2016: July 21, 2025 (KB5002760)

    Source
    Microsoft Support KB5002760 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8bebffbaedae013c…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    Microsoft advisory CVE-2025-49704ClaimedQuote verified8 Jul 2025

    Information published.

    every Known Affected product has a Vendor Fix and no later revision announces more updates

    Source
    Microsoft advisory CVE-2025-49704 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Microsoft advisory CVE-2025-49706ClaimedQuote verified8 Jul 2025

    Information published.

    every Known Affected product has a Vendor Fix and no later revision announces more updates

    Source
    Microsoft advisory CVE-2025-49706 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:286ec08a7ad2d910…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    MSRC blog: Customer guidance for SharePoint vulnerability CVE-2025-53770 (Wayback capture 2025-08-05)CuratedQuote verified21 Jul 2025

    Published SharePoint 2016 security updates, added links to SharePoint language packs, and updated customer guidance 07/21/25

    Revision 5.0 of the guidance.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0365e16d2d87cf72…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

Send this to your boss

SharePoint Server 'ToolShell' attacks: July 8 fix partial; full fixes July 20-21

Attackers took over on-premises SharePoint servers through flaws that, Microsoft later said, its July 8, 2025 updates only partially addressed; Microsoft published mitigations on July 19 and complete fixes on July 20 (Subscription Edition, 2019) and July 21, 2025 (2016).

In plain words

Microsoft SharePoint, when run on our own servers, had serious flaws that let attackers take over servers without a password, and they were attacked worldwide in July 2025. Microsoft says its July 8 update only partially addressed them; complete fixes came on July 20 for the newer versions and on July 21, 2025 for SharePoint 2016. If we run SharePoint on our own servers, we need the July 20/21 update (or later), new server keys, and a check for break-ins. SharePoint Online in Microsoft 365 was not affected.

What happened and who is affected

What happened

On July 8, 2025 Microsoft fixed two SharePoint flaws (CVE-2025-49704 and CVE-2025-49706), but it later said those updates only partially addressed them. Eye Security reported mass exploitation of internet-facing on-premises servers on the evening of July 18, and Microsoft says exploitation attempts began as early as July 7. Microsoft published CVE-2025-53770 (CVSS 9.8) on July 19 (Pacific time) with interim mitigations, and CVE-2025-53771 (CVSS 6.5) on July 20. Complete updates followed for Subscription Edition and 2019 on July 20 and for 2016 on July 21; SharePoint Online (Microsoft 365) was not affected.

Who is affected

Organizations running on-premises Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019 or SharePoint (Enterprise) Server 2016, especially if reachable from the internet. Older unsupported versions (2010, 2013) receive no fix.

CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/microsoft-cve-2025-53770/

Affected products

  • Microsoft SharePoint Server Subscription Edition
  • Microsoft SharePoint Server 2019
  • Microsoft SharePoint (Enterprise) Server 2016
How we built this timeline

Selected as a patch-day exception. Correction pass 23 Oct 2026: regrouped under R7 and R1.

(1) Grouping: CVE-2025-49704/49706 (disclosed 8 Jul 2025) and their bypasses CVE-2025-53770/53771 (19 Jul 2025/20) form one exploited chain disclosed within 12 days, so they are one incident; primary CVE-2025-53770 leads the MSRC guidance and has the highest CVSS (9.8; 49704 8.8; 49706 and 53771 6.5). (2) R1: the 8 Jul 2025 updates (KB5002741 2019, KB5002744 2016, KB5002751 SE, all titled 'July 8, 2025') are not recorded as First fix: the MSRC guidance says 'Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update', and the CVRF FAQ says 'Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704.' Microsoft did not present the July 8 updates as a mitigation, so they are not a Workaround candidate either.

World is therefore the 8 Jul 2025 disclosure and exposure runs to the 20 Jul 2025 complete fix. exploited before a fix=true (R4): Microsoft Threat Intelligence (22 Jul 2025): 'As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704'; Eye Security saw mass exploitation from 18 Jul 2025; both precede the 20 Jul 2025 complete fix.

Eye's 29 Jul 2025 correction says the traffic it saw matched the original 49706/49704 chain, which this grouping now covers. MSRC CVRF timestamps are Pacific dates (T07:00:00), so day precision is used for them. ransomware=true follows KEV ('Known').

The live MSRC blog URL redirects to the blog index, so a Wayback capture is cited. Brief corrected 23 Oct 2026: CVE-2025-53771 was published 20 Jul 2025 with CVSS 6.5 (not 07-19 at 9.8), and the headline is now within 80 characters.

Related

Microsoft report card