Microsoft SharePoint Remote Code Execution

critical Web App Scanning Plugin ID 114923

Synopsis

Microsoft SharePoint Remote Code Execution

Description

Microsoft SharePoint Server Subscription Edition < 16.0.18526.20508 or 2016 < 16.0.5513.1001 or 2019 < 16.0.10417.20037 is affected by a vulnerability that allows an unauthenticated attacker to execute arbitrary code through insecure deserialization.

Solution

Upgrade to Microsoft Server Subscription Edition build 16.0.18526.20508 or SharePoint Server 2016 build 16.0.5513.1001 or 2019 build 16.0.10417.20037 or later.

See Also

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770

Plugin Details

Severity: Critical

ID: 114923

Type: remote

Family: Component Vulnerability

Published: 7/24/2025

Updated: 7/24/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-53770

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2025-53770

Vulnerability Information

CPE: cpe:2.3:a:microsoft:sharepoint:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/19/2025

Vulnerability Publication Date: 7/18/2025

CISA Known Exploited Vulnerability Due Dates: 7/21/2025

Reference Information

CVE: CVE-2025-53770, CVE-2025-53771

CWE: 287, 502

OWASP: 2010-A3, 2010-A4, 2013-A2, 2013-A4, 2013-A9, 2017-A2, 2017-A8, 2017-A9, 2021-A6, 2021-A7, 2021-A8

WASC: Improper Input Handling, Insufficient Authentication

CAPEC: 114, 115, 151, 194, 22, 57, 586, 593, 633, 650, 94

DISA STIG: APSC-DV-000460, APSC-DV-002560, APSC-DV-002630

HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)

ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5

NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10(5)

OWASP API: 2019-API7, 2019-API8, 2023-API8

OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.5.1

PCI-DSS: 3.2-6.2, 3.2-6.5.1, 3.2-6.5.10