Organizations operating on-premise Microsoft SharePoint servers are advised to update immediately after reports surfaced of active exploitation of two critical vulnerabilities called ToolShell. These flaws—designated CVE-2025-53770 and CVE-2025-53771—allow attackers to execute remote code and spoof servers, posing a significant threat to SharePoint deployments worldwide.

The vulnerabilities stem from an attack chain disclosed during a cybersecurity event this May. Attackers are exploiting these flaws to steal cryptographic keys from unpatched servers, which lets them submit forged requests and carry out remote code execution. This threat is not limited to theoretical scenarios—global government, enterprise, healthcare, and education systems have already been reported as compromised.

Security experts warn that these attacks are sophisticated, involving the installation of persistent backdoors and bypassing identity protections to access files, system configurations, and potentially move laterally within the network. Some experts highlight that simply applying the latest patch might not be enough; organizations must also rotate their cryptographic keys to close off access to attackers who may have already stolen these secrets.

The discovery of ToolShell was first made by security researchers who noticed suspicious activity originating from brute-force attempts, only to find that attackers did not require authentication, confirming a zero-day was being used. Around 8,000 SharePoint servers were scanned, with dozens confirmed compromised in two waves of attacks.

This incident underscores the risk of relying on outdated trust models. Security leaders are urged to rethink perimeter and credential-based security in favor of a zero-trust approach, tightly segmenting networks and constantly monitoring for unusual behavior. Organizations are strongly recommended to treat any exposed SharePoint server as compromised until proven otherwise, follow Microsoft’s advice, apply the latest patches, and immediately rotate relevant cryptographic secrets to limit ongoing risk.