Update 2025-07-21, 10:40 UTC: Blog has been updated with additional indicators of compromise (IOCs)
Microsoft has partially patched a zero-day vulnerability in SharePoint following reports of its exploitation in the wild. The vulnerability (CVE-2025-53770), dubbed ToolShell, affects on-premises SharePoint servers and gives an attacker unauthenticated access to vulnerable servers, allowing them to remotely execute code and access all content and file systems. While the 2019 version of SharePoint Server and SharePoint Server Subscription Edition have been patched, the 2016 version remains unpatched.
In its guidance on the vulnerability, Microsoft said it was “aware of active attacks targeting on-premises SharePoint Server customers”. It provided no further information on which actors were behind these attacks.
The new zero-day vulnerability is a variant of a recently patched vulnerability, CVE-2025-49704, which was patched in July 2025.
Protection
Symantec products already block exploitation of this vulnerability with the following network protection: Web Attack: Microsoft SharePoint CVE-2025-49704.
Related vulnerabilities
A second, related vulnerability (CVE-2025-53771) has also been patched. A path traversal bug, it allows an authorized attacker to perform spoofing over a network. It too is a variant of a recently patched vulnerability (CVE-2025-49706) and the patch includes more robust protections against exploitation of the older flaw.
Mitigation and guidance
In addition to immediately updating to the latest version of SharePoint, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) is advising users to monitor for POSTs to:
/_layouts/15/ToolPane.aspx?DisplayMode=Edit
Users are also advised to conduct scanning for the following IP addresses: 107.191.58[.]76, 104.238.159[.]149, and 96.9.125[.]147, particularly between July 18-19, 2025.
Protection/Mitigation
Network protection
Web Attack: Microsoft SharePoint CVE-2025-49704
For the latest protection updates, please visit the Symantec Protection Bulletin.
Indicators of Compromise
If an IOC is malicious and the file available to us, Symantec Endpoint products will detect and block that file.
Note: IP addresses are a mixture of IPs scanning for and activity exploiting CVE-2025-53770
107.191.58[.]76
104.238.159[.]149
96.9.125[.]147
103.186.30[.]186
108.162.221[.]103
128.49.100[.]57
154.47.29[.]4
162.158.14[.]149
162.158.14[.]86
162.158.19[.]169
162.158.90[.]110
162.158.94[.]121
162.158.94[.]72
18.143.202[.]126
18.143.202[.]156
18.143.202[.]185
18.143.202[.]204
45.40.52[.]75