An unauthenticated SharePoint RCE chain dubbed ToolShell (CVE-2025-49704, CVE-2025-49706) is being actively exploited globally, granting attackers full control of on-premise servers.

A critical SharePoint zero-day (CVE-2025-53770, CVSS 9.8) is actively exploited in the wild, leveraging ToolShell to gain unauthenticated RCE on on-premises servers.

A critical SharePoint zero-day (CVE-2025-53770) is actively exploited, compromising over 100 organizations globally by stealing cryptographic keys and enabling persistent remote access.

Understanding the technical details, business impact, and response strategies for the zero-day vulnerability affecting SharePoint Server…

Kaspersky reports the ToolShell exploit chain (CVE-2025-49706, -49704, -53770, -53771) actively targets SharePoint servers globally, enabling unauthenticated RCE and auth bypass.

A new ransomware strain, 4L4MD4R, is now exploiting the ToolShell SharePoint vulnerability chain, which is already being used by China-linked APTs to compromise hundreds of organizations globally.

CISA issues an urgent warning about "ToolShell," a sophisticated exploit chain targeting SharePoint servers with multiple vulnerabilities to install webshells and steal crypto keys.

Hackers exploited the ToolShell SharePoint RCE flaw (CVE-2025-53770) to deploy Zingdoor and ShadowPad in attacks on global telecom and government targets.

GOLD SALEM (Storm-2603) is exploiting SharePoint via ToolShell then abusing the Velociraptor DFIR tool as a ransomware precursor. The group deploys Warlock and LockBit 3.0 variants, often targeting critical infra.