Skip to content
Cyber Security

SharePoint ToolShell (CVE-2025-53770): patch, rotate keys, then hunt

How the July 2025 ToolShell attacks on on-premises SharePoint worked, who is affected, and why patching alone does not remove the attacker.

Geidi Security Operations Team5 min read

In brief

What it is
ToolShell (CVE-2025-53770) let attackers run code on on-premises SharePoint servers without logging in, from July 2025.
Who it affects
Organisations that run SharePoint Server themselves; SharePoint Online in Microsoft 365 was never affected.
What to do
Install the July 2025 updates or later, turn on AMSI with antivirus, rotate the machine keys, then hunt for signs of the attacker.
On this page
  1. How it works
  2. Are you affected?
  3. How to fix it
  4. Every month since has mattered too
  5. If you think it already happened
  6. Where Geidi fits
  7. Sources

In July 2025, attackers started breaking into on-premises SharePoint servers faster than Microsoft could close the door. The flaw, CVE-2025-53770 and nicknamed "ToolShell", let someone on the internet run code on a SharePoint server without logging in. Microsoft rated it 9.8 out of 10, and within days it was being used by state-backed groups and a ransomware crew.

First, the good news for most readers. If your SharePoint is the one inside Microsoft 365 (SharePoint Online), this was never your problem. Microsoft was clear that only servers you run yourself are affected.

If you do run your own SharePoint server, especially one reachable from the internet, read on. The fix has an extra step that plenty of people skipped.

How it works

It started with two bugs Microsoft patched on 8 July 2025: CVE-2025-49706, which let an attacker pretend to be logged in, and CVE-2025-49704, which let a logged-in user run code. Chained together, they gave an outsider remote code execution. Microsoft says exploitation attempts began as early as 7 July.

Attackers then found ways around those July patches. Microsoft published CVE-2025-53770 (a bypass of the 49704 fix) and CVE-2025-53771 (a bypass of the 49706 fix) on 19 and 20 July, followed within days by new updates for every supported version. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalogue on 20 July.

The clever, nasty part is what the attackers did once inside. They dropped a small web page, usually called spinstall0.aspx, whose only job was to read the server's ASP.NET machine keys and hand them back. Those keys are what SharePoint uses to sign and trust data it sends to browsers. With a copy of them, an attacker can craft requests the server accepts as genuine, and that keeps working after you install the patch.

Microsoft named three groups using it: Linen Typhoon and Violet Typhoon, both Chinese state actors, and Storm-2603, which it saw deploying Warlock ransomware through these flaws from 18 July 2025.

Are you affected?

You are in scope if you run any of these on your own servers or in your own cloud tenancy:

  • SharePoint Server Subscription Edition
  • SharePoint Server 2019
  • SharePoint Server 2016

SharePoint Server 2013 and older are past end of support and got no fix. CISA's advice is blunt: if one of those is on the internet, take it off.

The server being reachable from outside your network is what turned this from a patching job into an emergency. A SharePoint server that only answers inside the office or over VPN was much harder to reach, but it still needs the same fix.

How to fix it

Order matters here, because the keys are the thing the attacker may already hold.

  1. Install the July 2025 updates or anything later. The fixing updates were KB5002768 for Subscription Edition, KB5002754 plus the language pack update KB5002753 for 2019, and KB5002760 plus KB5002759 for 2016. Installing the current cumulative update covers them.
  2. Turn on AMSI in Full Mode and run Defender Antivirus (or an equivalent) on every SharePoint server. AMSI lets the antivirus inspect requests before SharePoint processes them. Microsoft switched it on by default in the September 2023 update for 2016 and 2019 and in Version 23H2 of Subscription Edition, so check nobody turned it off. If you can't enable it, Microsoft's advice is to disconnect the server from the internet until it is patched.
  3. Rotate the ASP.NET machine keys. Use the Set-SPMachineKey PowerShell cmdlet, or in Central Administration go to Monitoring, Review job definitions, find the Machine Key Rotation Job and choose Run Now. CISA's version is rotate, patch, then rotate again.
  4. Restart IIS on every SharePoint server with iisreset.exe. Microsoft updated its guidance on 23 July 2025 specifically to stress this step, so don't skip it.
  5. Deploy endpoint detection and response on the servers, so anything the attacker does next is seen.

This will mean an outage window and some grumbling. That's a good trade for a server that may be holding your contracts and HR files.

Every month since has mattered too

ToolShell was not a one-off. Between March and September 2026, CISA added eight more on-premises SharePoint vulnerabilities to its exploited list, the latest on 25 September 2026. If you are keeping SharePoint on your own hardware, monthly patching within days of release is the price of admission. Our FortiGate patching guide makes the same point about firewalls, and the Essential Eight maturity levels explainer sets out the timeframes.

If you think it already happened

Patching and rotating keys stops new break-ins. It does not remove anything already there. Look for:

  • Files named spinstall*.aspx (or similar new .aspx files) under the SharePoint TEMPLATE\LAYOUTS folders for versions 15 and 16.
  • The IIS worker process w3wp.exe starting cmd.exe or encoded PowerShell.
  • Microsoft Defender protections being switched off through the registry, which Microsoft saw Storm-2603 do.
  • Unknown modules registered in applicationHost.config or web.config. CISA warns these reload on every IIS restart until you remove them by hand.

If you find any of that, treat the server and any accounts it could reach as compromised, and bring in incident response before you start deleting things. Report it to ASD's ACSC at cyber.gov.au (opens in a new tab) ("Cybercrime" for most businesses, "Cyber security incident" for organisations with 250 or more staff, government and critical infrastructure) or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). If personal information stored in SharePoint may have been accessed, check whether the Notifiable Data Breaches scheme applies.

Where Geidi fits

SharePoint is part of our Cloud and Business Systems service, and our cyber security services are aligned to the Essential Eight and backed by a 24/7 security operations centre. If you'd like help patching, checking or retiring an on-premises SharePoint server, talk to us.

Sources

More on Cyber Security

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049