Threat Intelligence / CVE / CVE-2025-53771

CVE-2025-53771 — Microsoft Sharepoint Server

CVSS v3.1 6.5 (MEDIUM) · EPSS 39.6% (higher than 97.3% of all scored CVEs) · Priority 7.1/10 · Published 2025-07-20

As of 2025-08-14, CVE-2025-53771 is a MEDIUM-severity vulnerability in Microsoft Sharepoint Server, CVSS v3.1 6.5, EPSS 39.6% (97.3th percentile). Threadlinqs Intelligence links 3 tracked threat campaigns to CVE-2025-53771, most recently “CVE-2026-45659: SharePoint Deserialization RCE Added to CISA KEV Amid Storm-2603 Exploitation”.

Last updated: 2025-08-14

What is CVE-2025-53771?

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

The record classifies CVE-2025-53771 under weakness class CWE-287. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction. 3 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 419 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 6.5 — MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS (FIRST): 39.6% probability of exploitation in the next 30 days, higher than 97.3% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 7.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2025-07-20, last modified 2025-08-14

Is CVE-2025-53771 being exploited?

It currently carries a trending score of 29 in the Threadlinqs vulnerability feed.

Affected products and versions

Microsoft: Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019

How to fix CVE-2025-53771

The record marks a vendor fix as available for CVE-2025-53771. Patch reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771. Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2025-53771

3 tracked threats in the Threadlinqs corpus reference CVE-2025-53771, either in the campaign’s CVE list or as an indicator on the campaign record.

CVE-2026-45659: SharePoint Deserialization RCE Added to CISA KEV Amid Storm-2603 Exploitation — HIGH · 2026-07-02
CVE-2026-45659: Microsoft SharePoint Deserialization RCE Actively Exploited, Added to CISA KEV — HIGH · 2026-07-02
Warlock (Water Manaul / Storm-2603) Ransomware Campaign with BYOVD, Web Shells, and Multi-Channel Tunneling via SharePoint Exploitation — CRITICAL · 2026-03-16

Sources

Seeded from nvd and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2025-53771 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence