Microsoft SharePoint ToolShell path traversal spoofing vulnerability

By itself, CVE-2025-53771 enables spoofing/security-bypass behavior in SharePoint and facilitates path traversal-style access that can undermine prior protections for CVE-2025-49706. Its operational significance is highest when chained with CVE-2025-53770 as part of ToolShell, where it helps attackers bypass authentication or security controls and reach code-execution paths on vulnerable SharePoint servers. Reporting on ToolShell campaigns links the combined exploitation chain to large-scale compromise of on-premises SharePoint environments, including web-shell deployment, theft of ASP.NET MachineKey material, credential dumping, lateral movement, persistence, and in some cases ransomware deployment.

If immediate patching is not possible, reduce exposure of on-premises SharePoint servers by disconnecting them from the Internet or restricting unauthenticated access through VPN, reverse proxy, or an authentication gateway. Ensure AMSI is enabled and correctly configured in SharePoint, preferably with Full Mode HTTP request body scanning, and deploy Microsoft Defender Antivirus/Defender for Endpoint or equivalent controls to detect and block exploitation and post-exploitation activity. Monitor for ToolShell indicators such as suspicious POST requests to ToolPane endpoints, creation of spinstall0.aspx or related ASPX files under SharePoint LAYOUTS paths, and anomalous child processes spawned by w3wp.exe. Because ToolShell activity involved theft of MachineKeys, defenders should also rotate keys and investigate for compromise if exposure existed before patching.

Apply Microsoft's July 2025 comprehensive SharePoint security updates that fully address CVE-2025-53771 and the related ToolShell issues. Supported products called out in the content include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. SharePoint 2010 and 2013 are reported as unsupported for these fixes and should be migrated to supported versions. After patching, Microsoft guidance in the supplied content also recommends rotating SharePoint ASP.NET machine keys and restarting IIS on all SharePoint servers to invalidate potentially stolen key material and complete remediation steps associated with ToolShell compromise response.