Microsoft releases emergency fixes for actively exploited SharePoint security flaws
Microsoft has released emergency patches for two remote code execution vulnerabilities in SharePoint. The CVE-2025-53770 and CVE-2025-53771 security flaws are addressed by KB5002768 and KB5002754.
The issue was discovered by security researchers back in May, when it was found that the vulnerability allows for RCE attacks dubbed ToolShell. Microsoft had tried to plug the security holes earlier in the month with the July Security Update, but this only partly addressed the problem – hence the need for the emergency, out-of-band patches.