Microsoft SharePoint Deserialization RCE

Successful exploitation allows remote code execution in Microsoft Office SharePoint by an authorized attacker. In practical terms, this can enable execution of attacker-supplied code on the target SharePoint server, which may lead to full compromise of the SharePoint application and potentially broader impact to connected enterprise resources depending on the server's privileges and environment.

Prioritize deployment of the September 9, 2025 Microsoft security updates after appropriate testing. Until patching is complete, reduce exposure by limiting SharePoint access to trusted users and networks, closely monitoring SharePoint servers for suspicious activity, and preparing incident response actions if exploitation is suspected. The provided content does not include a SharePoint-specific vendor workaround beyond patching.

Apply Microsoft's September 2025 security updates for affected Microsoft products, including the patch addressing CVE-2025-54897, in accordance with the September 2025 Patch Tuesday guidance referenced in the provided advisories. Validate patch deployment through normal patch compliance processes and investigate any indications of prior compromise separately, as patching does not remediate historical attacker access.