SharePoint ToolShell authentication bypass / spoofing vulnerability
CVE-2025-53771 is a Microsoft Office SharePoint vulnerability associated with the ToolShell exploit chain and described by Microsoft as an improper authentication / spoofing issue. The provided content also repeatedly characterizes it as a path traversal variant and as a security bypass for the earlier CVE-2025-49706 fix. Technical reporting in the content states the vulnerable logic is in Microsoft.SharePoint.dll, specifically SPRequestModule.PostAuthenticateRequestHandler(), where authentication could be skipped for requests influenced by SignOut.aspx referrer handling. Microsoft’s earlier July 2025 fix for CVE-2025-49706 added ToolPane.aspx-specific checks, but researchers reported that this could be bypassed, including by modifying the request path (for example, appending a trailing slash). Microsoft subsequently issued CVE-2025-53771 as a more comprehensive fix, replacing the narrow ToolPane.aspx check with an allowlist of permitted paths for requests using the sign-out page as referrer. In practice, CVE-2025-53771 was used as the authentication/spoofing bypass component of ToolShell and could be chained with CVE-2025-53770 to enable unauthenticated exploitation of on-premises SharePoint servers.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No valid public exploits. Mallory filtered out 2 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
171 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft SharePoint Server vulnerability used in combination with CVE-2025-53770 in the ToolShell exploit chain and exploited in the wild.
A Microsoft SharePoint zero-day vulnerability (not further described in the content) reported as one of the most routinely targeted and exploited-in-the-wild vulnerabilities of 2025.
A SharePoint vulnerability referenced as being chained with CVE-2025-53770 in attacks targeting US government agencies and others.
A zero-day vulnerability in Microsoft SharePoint servers exploited by Chinese APT Linen Typhoon for initial access and espionage.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.