CyberzSOC

CISA is aware of active exploitation of a spoofing and RCE vulnerability chain involving CVE-2025-49706 and CVE-2025-49704 , enabling unauthorized access to on-premise SharePoint servers. While the scope and impact continue to be assessed, the chain, publicly reported as “ToolShell,” provides unauthenticated access to systems and authenticated access through network spoofing, respectively, and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network. Beyond the typical webshells, such as .aspx and .exe, .dll payloads have been observed during exploitation. Most recently, threat actors have also been observed encrypting files and distributing Warlock ransomware on compromised systems. While not actively exploited, Microsoft has identified the following new CVEs that pose a potential risk: CVE-2025-53771 is a patch bypass for CVE-2025-49706. If AMSI cannot be enabled, disconnect affected products from service that are public-facing on the internet until official mitigations are available.