CVE-2025-3770: 
CBL Mariner vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-53770) was discovered in on-premises Microsoft SharePoint Server, involving deserialization of untrusted data that allows unauthorized attackers to execute code over a network. The vulnerability was initially disclosed on July 19, 2025, and affects SharePoint Server 2016, 2019, and Subscription Edition. Microsoft confirmed active exploitation in the wild, assigning it a CVSS score of 9.8 (Critical) (Microsoft Update Guide).

The vulnerability (CVE-2025-53770) is classified as a deserialization of untrusted data issue (CWE-502). It received a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability (Microsoft Update Guide, MSRC Blog).

The vulnerability enables unauthorized attackers to execute arbitrary code over a network, potentially leading to complete system compromise. The high severity rating indicates significant risks to confidentiality, integrity, and availability of affected SharePoint servers. SharePoint Online in Microsoft 365 is not impacted by this vulnerability (MSRC Blog).

Microsoft has released security updates for all affected versions of SharePoint Server. Organizations are advised to immediately apply these updates and implement several mitigations: configure Antimalware Scan Interface (AMSI) integration in SharePoint, deploy Microsoft Defender Antivirus on all SharePoint servers, rotate SharePoint Server ASP.NET machine keys, and restart IIS on all SharePoint servers. If AMSI cannot be enabled, organizations should consider disconnecting affected servers from the Internet until patches are applied (MSRC Blog).

The security community has expressed significant concern over the active exploitation of this vulnerability. Discussions on platforms like Hacker News and social media highlight the critical nature of the threat and the urgency of applying patches. Security researchers have actively shared detection methods and hunting techniques to help organizations identify potential compromises (Hacker News, Dark Reading).