返回 CVE 浏览器

CVE-2025-53770

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-07-20

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Affected Platforms (CPE)

📦

Microsoft

Sharepoint Server

< 16.0.18526.20508= 2016= 2019

References & Advisories

🔗 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770

🔗 https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/

🔗 https://github.com/kaizensecurity/CVE-2025-53770

🔗 https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

🔗 https://news.ycombinator.com/item?id=44629710

🔗 https://research.eye.security/sharepoint-under-siege/

🔗 https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally

🔗 https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/

相關資安分析文章

周度网络安全新闻：2026 年 7 月 27 日

本周重大安全周报聚焦于 Check Point SmartConsole CVE-2026-16232 验证绕过之在野利用、PAN-OS GlobalProtect 漏洞与 Qilin 勒索软件侵袭、俄罗斯 LAUNDRY BEAR 对 Zimbra 进行之国家级电子邮件间谍活动，以及 Windchill 与 FakeGit 恶意 Repositories 威胁趋势。

全球网络威胁情报摘要：2026 年 7 月 23 日

本期情报重点包含 CISA 将 Langflow CVE-2026-0770 远程代码执行漏洞列入 KEV 已知利用目录、Windmill CVE-2026-29059 未经身份验证路径穿越漏洞分析，以及 SonicWall SMA1000 零日漏洞利用持续追踪与防御建议。

全球网络威胁情报摘要：2026 年 7 月 22 日

本期摘要重点分析本地部署 Microsoft SharePoint 服务器正遭主动利用之 CVE-2026-50522 漏洞、Qilin 勒索软件利用 PAN-OS CVE-2026-0257 身份验证绕过入侵企业 VPN，以及 Cisco 安全设备与关键基础设施修补处置指南。

相关漏洞威胁

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL be...

CVE-2026-174582.1

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser...

CVE-2026-174342.1

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-...

CVE-2026-174331.9

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file sr...