"ToolShell" vulnerabilities in on-premises SharePoint are exploited to steal server keys (2025)
Microsoft observed attackers exploiting on-premises SharePoint Server vulnerabilities (CVE-2025-53770 and CVE-2025-53771, related to CVE-2025-49704 and CVE-2025-49706) against internet-facing servers, with attempts as…
What happened
- Microsoft observed attackers exploiting on-premises SharePoint Server vulnerabilities (CVE-2025-53770 and CVE-2025-53771, related to CVE-2025-49704 and CVE-2025-49706) against internet-facing servers, with attempts as early as July 7, 2025.Disrupting active exploitation of on-premises SharePoint vulnerabilities
- Microsoft named Chinese state actors Linen Typhoon and Violet Typhoon and the China-based actor Storm-2603 among those exploiting them.Disrupting active exploitation of on-premises SharePoint vulnerabilities
- Besides installing the updates, Microsoft told customers to rotate SharePoint servers' ASP.NET machine keys and restart IIS, because exploitation exposed those keys.Disrupting active exploitation of on-premises SharePoint vulnerabilities
The failure pattern
Watch the pattern: Known vulnerability left unremediated
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Patch internet-facing servers on a short deadlineTrack exposed systems and apply emergency updates within days when exploitation is reported.
- Rotate secrets after a compromise, not only patchTreat cryptographic keys and tokens on an exploited server as stolen and replace them as part of remediation.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- IA-2 Identification and Authentication
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- RV.1.1 Gather vulnerability information from public sources
- RV.2.2 Plan and implement risk responses
- Goal 1 Multi-factor authentication
- Goal 2 Default passwords
- Goal 4 Security patches
- CWE-308 Use of Single-factor Authentication
- CWE-1395 Dependency on Vulnerable Third-Party Component
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
SQL injection in MOVEit Transfer exploited by the CL0P ransomware gang (2023)
CISA and the FBI report that the CL0P ransomware gang exploited a SQL injection vulnerability (CVE-2023-34362) in Progress MOVEit Transfer beginning May 27, 2023, installing a web shell called LEMURLOOT.
Log4Shell: remote code execution through JNDI lookups in Apache Log4j (2021)
CVE-2021-44228 (Log4Shell) affects Apache Log4j 2.0-beta9 through 2.14.1 and lets an unauthenticated remote actor execute arbitrary code through JNDI lookups.
Capital One cloud breach and an $80 million OCC penalty for weak cloud-migration risk assessment (2019)
The OCC assessed an $80 million civil money penalty against Capital One for failing to establish effective risk assessment processes before migrating significant IT operations to the public cloud and for not correcting…
Unpatched web-application vulnerability (Apache Struts) leads to the Equifax breach (2017)
Apache Struts CVE-2017-5638 parser bug left unpatched for 2 months; attackers executed arbitrary commands and accessed unencrypted databases of 147M Americans.
F5, Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, October 2025)
On August 9, 2025, F5, Inc. (the “Company”, “F5”, “we”, or “our”) learned that a highly sophisticated nation-state threat actor had gained unauthorized access to certain Company systems.
Self-replicating "Shai-Hulud" worm compromises more than 500 npm packages by stealing developer tokens (2025)
CISA reported that a self-replicating worm known as "Shai-Hulud" had compromised more than 500 npm packages.