CVE-2025-53771

Medium6.5Published on July 20, 2025

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Early warning: exploitation observed

Exploitation observed since Jul 18, 2025
Not yet in the official CISA catalogue
Attacked 3 days before the vulnerability was made public
Used in ransomware campaigns

Source: VulnCheck KEV · Oct 1, 2026 Sep 16, 2026 Jul 1, 2026 Jun 3, 2026 May 24, 2026 Apr 18, 2026

CVSS score6.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness type (CWE)CWE-287

Vendorsmicrosoft

Affected products

Vendors	Product	Versions
microsoft	sharepoint server	< 16.0.18526.20508

Ransomware

Warlock Uses On-Premises SharePoint to Deploy Ransomware on at Least 33 Hosts

China-linked Warlock ransomware exploited on-premises SharePoint flaws to breach utilities and governments, deploying ransomware on 33+ hosts via SYSVOL.

Oct 3, 202605:275 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Affected products

Related articles

Warlock Uses On-Premises SharePoint to Deploy Ransomware on at Least 33 Hosts