On-Premises SharePoint Server “ToolShell” Backdoor – Advisory for Mitigation and Response
Organizations Urged to Address Critical Security Flaws to Prevent Unauthorized Access to On-Premises SharePoint Servers.
Key Insights
- Critical vulnerability chain: Two SharePoint Server flaws, CVE-2025-49704 (authenticated RCE) and CVE-2025-49706 (authentication spoofing), can be chained together to enable threat actors to gain remote code execution with farm-level privileges on vulnerable SharePoint servers.
- Active exploitation confirmed: Disclosed on Microsoft’s Patch Tuesday (July 8, 2025), with reliable exploitation techniques—nicknamed “ToolShell”—observed in the wild starting July 18, 2025.
- Persistent access mechanism: Attackers extract ASP.NET machine keys used to sign authentication tokens, allowing user impersonation and persistent, credential-less access that survives initial patching efforts.
- Enterprise-wide impact: Successful compromise grants complete visibility into and control over all SharePoint content, and can serve as a launching point for lateral movement across the entire network infrastructure.
- Patches available: Microsoft has released cumulative updates for all affected versions. System reboot is required after installation and machine key rotation to ensure complete remediation.
- Immediate action required: Organizations must patch immediately, rotate machine keys, conduct threat hunting on exposed servers, and validate security monitoring coverage to prevent long-term, undetected intrusion.
Introduction
This advisory addresses the latest disclosed SharePoint Server vulnerabilities that can be chained to install the ToolShell backdoor. When successfully exploited, these flaws allow a remote, unauthenticated attacker to impersonate any user and execute arbitrary code under the high-privilege sp_farm account, effectively compromising the entire SharePoint environment.
Background
SharePoint Server continues to serve as a critical collaboration platform for organizations worldwide. On July 8, 2025, Microsoft published CVE-2025-49704 and CVE-2025-49706 with High-to-Critical severity ratings. Proof-of-concept exploit code emerged approximately one week later, and multiple incident response teams have since confirmed active exploitation in enterprise environments.
The vulnerability chain is particularly dangerous when SharePoint Web Front End (WFE) servers are internet-facing. Attackers can exploit CVE-2025-49706 (authentication spoofing) in combination with CVE-2025-49704 (code injection) to deploy PowerShell-based web shells, harvest credentials, and extract critical machine keys. These extracted keys allow forged FedAuth cookies to remain valid even after patching, unless organizations specifically rotate the keys and reboot affected systems.
Relevance and Impact for Your Organization
Successful exploitation completely compromises the integrity and confidentiality of the entire SharePoint farm. Threat actors who successfully exploit these vulnerabilities can:
- Exfiltrate or manipulate sensitive documents, lists, and other SharePoint content
- Modify farm configuration settings and timer jobs to establish persistent access
- Forge authentication tokens to impersonate any SharePoint user or downstream cloud service user
- Leverage harvested credentials or Single Sign-On tokens for lateral movement throughout the network
The combination of these capabilities creates a high risk of long-term, undetected intrusion, significant data loss, regulatory compliance violations, and operational disruption. Organizations must treat this as a critical security incident requiring immediate containment, patching, and comprehensive investigation.
What You Should Do
Immediate Actions (Within 24 Hours)
- Emergency patching: Schedule maintenance windows and deploy July 2025 cumulative updates across all SharePoint farms; ensure restart of the IIS service and plan the downtime accordingly.
- Access restriction: Ensure Web Front Ends are accessible only through authenticated reverse proxies (e.g., F5 BIG-IP APM, Microsoft Azure Application Proxy, Cloudflare Access, Zscaler Private Access) or VPNs with multi-factor authentication
- Enhanced monitoring: Deploy provided security monitoring rules and conduct retrospective threat hunting
- Incident reporting: Report any confirmed indicators of compromise to relevant regulatory authorities and engage contracted incident response providers according to organizational policies and regulatory requirements.
Follow-up Actions (Within 72 Hours)
- Certificate management: Rotate OAuth certificates and ASP.NET machine keys, followed by system reboot
- Credential rotation: Reset passwords for privileged SharePoint accounts (sp_farm, sp_admin, sp_content, application pool accounts) and the SharePoint SQL Server’s service accounts (SQL Server Engine, SQL Server Agent, database connection accounts)
- Threat hunting: Conduct comprehensive investigation of any previously internet-exposed SharePoint servers
- Legacy protocol disabling: Disable NTLM, Basic authentication, and legacy WebDAV protocols
Technical Guidance
General Details and Affected Products
| CVE | Severity (CVSS 3.1) | Vulnerability Type | Affected Builds |
| CVE-2025-49704 | 8.8 (High) | Authenticated RCE (CWE-94) | SharePoint SE ≤ 16.0.18526.20423; 2019 ≤ 16.0.10417.20026; 2016 ≤ 16.0.5474.1000 |
| CVE-2025-49706 | 7.1 (High) | Authentication spoofing (CWE-287) | Same as above |
Patching Details
| Product | Security Update | Notes |
| SharePoint Server Subscription Edition | KB5002768 | July 2025 Cumulative Update |
| SharePoint Server 2019 | KB5002754 + KB5002753 | July 2025 CU; language pack required |
| SharePoint Server 2016 | KB5002760 + KB5002759 | July 2025 CU; language pack required |
Critical notice: System reboot is mandatory after patching and machine key rotation to ensure cached authentication tokens are invalidated.
Hardening and Prevention
- Machine key rotation: Use Microsoft’s Set-SPMachineKey script to rotate ASP.NET machineKey validation and decryption keys
- Service account hardening: Implement least-privilege principles for service accounts; explicitly deny interactive logon rights to sp_farm and sp_service accounts
- Network segmentation: Place SharePoint servers behind authenticated reverse proxies or VPNs; avoid direct internet exposure.
- Legacy protocol management: Disable NTLM, Basic authentication, and legacy WebDAV protocols where not required for business operations
Monitoring and Detection
Organizations should implement the following detection mechanisms:
Process Monitoring:
- Monitor for unusual parent-child process relationships, particularly:
- w3wp.exe spawning powershell.exe with ‘EncodedCommand’ parameter
- w3wp.exe spawning unusual cmd.exe /c commands
These process chains rarely occur during normal SharePoint operations and serve as reliable indicators of ToolShell exploitation. If these indicators are detected, treat as an active compromise and immediately initiate incident response procedures in addition to the standard mitigation steps.
Log Analysis:
- Examine IIS access logs for unusual access attempts to the page ‘ToolPane.aspx’
- Enable AMSI-based PowerShell script block logging to detect obfuscated payloads
- Monitor for unexpected authentication patterns by service accounts associated with the SharePoint servers
- Search for System.Runtime.Serialization.SerializationException entries followed by compiler events in SharePoint ULS logs
Network Monitoring:
- Identify unexpected outbound traffic to unknown SharePoint Online tenant IDs
- Monitor for unusual data exfiltration patterns from SharePoint servers
- Track connections to command-and-control infrastructure
Threat Hunting Guidelines
For organizations that have had SharePoint servers exposed to the internet:
- Historical analysis: Review logs for the past 30 days, focusing on authentication anomalies and unusual process execution
- File system examination: Search for unexpected PowerShell scripts, text files in web paths, web files (asp, aspx, js, css, etc.), or configuration changes. Specifically look for new files in the path ‘C:\Program Files\Common Files\microsoft shared\Web Server Extensions\1[5-6]\TEMPLATE\LAYOUTS’
- Memory analysis: If possible, capture memory dumps from running SharePoint processes for forensic analysis
- Network forensics: Analyze network traffic logs for indicators of data exfiltration or command-and-control communication from the SharePoint servers outbound.
Appendices
References
- National Vulnerability Database – CVE-2025-49704
- National Vulnerability Database – CVE-2025-49706
- Microsoft Threat Intelligence: Disrupting active exploitation of on-premises SharePoint vulnerabilities
How Sygnia Can Help
Sygnia provides comprehensive incident response services to address ToolShell compromises, including rapid patch deployment, forensic investigation, threat hunting, and long-term security hardening for on-premises collaboration platforms. Our experts can assist in containing active breaches and implementing robust defense strategies to prevent future intrusions.
If you are currently impacted by this attack or are seeking guidance on how to prevent similar attacks, please contact us or access our 24-hour hotline +1-877-686-8680.
Disclaimer: This advisory is provided for general informational purposes and does not constitute legal or professional advice. While every effort has been made to ensure accuracy, this advisory is supplied “as-is” without warranty of any kind. Organizations should validate all technical guidance in their specific environments before implementation.
Omer Kidron, Eldad Hoshen, Bettina Cuevas. (2025, July 24). On-Premises SharePoint Server “ToolShell” Backdoor – Advisory for Mitigation and Response, Sygnia.
https://sygnia-stg.prpl.global/threat-reports-and-advisories/on-prem-sharepoint-toolshell-backdoor-advisory/
Related Resources
By clicking Subscribe, I agree to the use of my personal data in accordance with Sygnia Privacy Policy. Sygnia will not sell, trade, lease, or rent your personal data to third parties.