Which products and versions are affected by CVE-2025-53770?

Affected: Sharepoint Server (Microsoft) versions 2016, 2019; Microsoft SharePoint Enterprise Server 2016 versions >= 16.0.0; Microsoft SharePoint Server 2019 versions >= 16.0.0, among others. The full list is in the CVE brief.

Is CVE-2025-53770 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jul 18, 2025 and is known to be used in ransomware campaigns.

Is CVE-2025-53770 in the CISA KEV catalog?

Yes. It was added on Jul 20, 2025 with a federal remediation due date of Jul 21, 2025.

Is there a public exploit for CVE-2025-53770?

Public exploit code is available.

How urgently should CVE-2025-53770 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2025-53770

CriticalExploitedPublic exploit

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.

Published Jul 21, 2025 · Updated Aug 4, 2026 · Also known as TR-25-0162

Key Facts

Patch immediately

CVE-2025-53770 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Sharepoint Server (Microsoft), Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019 and 1 more product.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jul 18, 2025 and is known to be used in ransomware campaigns. Public exploit code is available.
EPSS estimates a 100% probability of exploitation in the next 30 days.
Fixed versions are available, including Microsoft SharePoint Enterprise Server 2016 16.0.5513.1001, Sharepoint Server 16.0.18526.20508, Microsoft SharePoint Server 2019 16.0.10417.20037.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

100%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2025-53770 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Jul 20, 2025	Jul 21, 2025	Known
Industry KEV feed	Jul 18, 2025	Jul 21, 2025	Known
CIRCL KEV	Jul 20, 2025	Jul 21, 2025	Known
ENISA EUVD	Jul 20, 2025	n/a	Not reported

Required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Affected Products

6 affected entries in total

Product	Affected versions	Fixed in
Sharepoint ServerMicrosoft	2016, 2019	16.0.18526.20508
Microsoft SharePoint Enterprise Server 2016	>= 16.0.0	16.0.5513.1001
Microsoft SharePoint Server 2019	>= 16.0.0	16.0.10417.20037
Microsoft SharePoint Server Subscription Edition	>= 16.0.0	16.0.18526.20508

Patched Releases

Microsoft SharePoint Enterprise Server 2016

16.0.5513.1001

Sharepoint Server

16.0.18526.20508

Microsoft SharePoint Server 2019

16.0.10417.20037

Microsoft SharePoint Server Subscription Edition

16.0.18526.20508

Timeline

Added to Industry KEV feed
Jul 18, 2025
Added to CISA KEV
Jul 20, 2025
Added to CIRCL KEV
Jul 20, 2025
Added to ENISA EUVD
Jul 20, 2025
Publicly disclosed
Jul 21, 2025
Last updated
Aug 4, 2026

Weakness Type

CWE-502 Deserialization of Untrusted Data

References

15 more references in the full CVE brief

FAQ

Common Questions.

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Affected: Sharepoint Server (Microsoft) versions 2016, 2019; Microsoft SharePoint Enterprise Server 2016 versions >= 16.0.0; Microsoft SharePoint Server 2019 versions >= 16.0.0, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jul 18, 2025 and is known to be used in ransomware campaigns.
Yes. It was added on Jul 20, 2025 with a federal remediation due date of Jul 21, 2025.
Public exploit code is available.
Fixed versions are available, including Microsoft SharePoint Enterprise Server 2016 16.0.5513.1001, Sharepoint Server 16.0.18526.20508, Microsoft SharePoint Server 2019 16.0.10417.20037.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2025-53770 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.