Microsoft has released critical updates and technical guidance addressing two actively exploited SharePoint vulnerabilities, CVE-2025-53770 and the closely related CVE-2025-53771. These vulnerabilities pose a significant risk to on-premises SharePoint environments, prompting urgent action from security and IT teams. Even if your organization uses SharePoint Online, you may still be at risk if vendors or partners in your supply chain are running vulnerable on-premises instances.

Below is a summary of the latest recommendations:

🔧 Security Updates

• SharePoint Subscription Edition: KB5002768
• SharePoint Server 2019: KB5002754
• SharePoint Server 2016: Patch pending
• SharePoint Online: Not affected

🛡️ Mitigation & Hardening Steps

1. Enable AMSI Integration
   Blocks unauthenticated RCE attempts.
   Enabled by default in SharePoint SE 23H2+ and SharePoint 2016/2019 (Sept 2023 CU+).
   Registry key:
   HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\WSS\Security\AMSIEnabled = 1
2. Deploy Microsoft Defender Antivirus
   Detects known payloads:
   Exploit:Script/SuspSignoutReq.A
   Trojan:Win32/HijackSharePointServer.A
3. Use Microsoft Defender for Endpoint
   Alerts for suspicious w3wp.exe behavior, web shell activity, and unusual PowerShell execution.
4. Rotate ASP.NET Machine Keys
   Required before and after patching to invalidate potentially compromised tokens.
   Located in web.config under <machineKey>.
5. Advanced Threat Hunting (Optional)
   Search for suspicious files like spinstall0.aspx in:
   C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS
   Use Defender 365 queries to identify lateral movement or persistence.
6. Isolate Servers if AMSI Cannot Be Enabled
   Temporarily remove internet access to reduce exposure.

Full Microsoft article can be found here: Customer guidance for SharePoint vulnerability CVE-2025-53770 | MSRC Blog | Microsoft Security Response Center

BACK TO BLOGS