SharePoint ToolShell Vulnerability Exploitation (CVE-2025-53770)

Duo Tech@duotech

•updated Oct 22, 2025•2•1•55

Detects potential exploitation of the ToolShell remote code execution vulnerability (CVE-2025-53770) in on-premises Microsoft SharePoint servers. Attackers have been observed sending POST requests to the 'ToolPane.aspx' endpoint and subsequently dropping webshells with specific names in the SharePoint LAYOUTS directory.