ToolShell CVE-2025-53770 – Detection and IOCs

Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770) https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

CISA Adds One Known Exploited Vulnerability, CVE-2025-53770 “ToolShell,” to Catalog https://www.cisa.gov/news-events/alerts/2025/07/20/cisa-adds-one-known-exploited-vulnerability-cve-2025-53770-toolshell-catalog

SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/

ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities

CVE-2025-53770: Widespread Exploitation of ToolShell RCE Vulnerability Observed in Microsoft SharePoint On-Premises https://arcticwolf.com/resources/blog/cve-2025-53770/

ToolShell: A SharePoint RCE chain actively exploited  https://www.varonis.com/blog/toolshell-sharepoint-rce

ToolShell: Details of CVEs affecting SharePoint servers https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/

ToolShell: Critical SharePoint Zero-Day Exploited in the Wild https://www.security.com/threat-intelligence/toolshell-zero-day-sharepoint-cve-2025-53770

SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild https://news.sophos.com/en-us/2025/07/21/sharepoint-toolshell-vulnerabilities-being-exploited-in-the-wild/

Responding to ToolShell: A Microsoft SharePoint zero-day vulnerability https://www.cyberark.com/resources/blog/responding-to-toolshell-a-microsoft-sharepoint-zero-day-vulnerability

Cloudflare protects against critical SharePoint vulnerability, CVE-2025-53770 https://blog.cloudflare.com/cloudflare-protects-against-critical-sharepoint-vulnerability-cve-2025-53770/