How to Protect Your Microsoft SharePoint Server from ToolShell RCE Attacks

Enterprise security teams are facing a critical race against time as a sophisticated exploit chain known as ToolShell continues to target on-premises Microsoft SharePoint servers. The attack leverages a combination of critical vulnerabilities to achieve unauthenticated remote code execution (RCE), granting attackers the ability to seize full control of vulnerable systems without requiring any valid credentials.

The ToolShell campaign primarily targets self-hosted environments, specifically Microsoft SharePoint Server 2016, SharePoint Server 2019, and the SharePoint Server Subscription Edition. By exploiting unsafe deserialization of untrusted data within the ToolPane.aspx component, attackers can bypass authentication and execute arbitrary code on the server, potentially leading to the deployment of web shells and the theft of sensitive machine keys to maintain long-term persistence according to analysis by Fastly.

Because SharePoint often serves as a central hub for corporate intelligence, the impact of a compromise extends far beyond the server itself. Once an attacker gains a foothold via ToolShell, they can harvest sensitive content and potentially pivot to other integrated Microsoft services, including Outlook, Teams, and OneDrive, creating a cascading security failure across the organization’s productivity suite.

Understanding the ToolShell Exploit Chain

The ToolShell threat is not a single bug but a coordinated attack chain. At its core, the exploit relies on two primary vulnerabilities: CVE-2025-53770, which enables the remote code execution, and CVE-2025-53771, which facilitates server spoofing as detailed by Forescout Research. This combination allows attackers to trick the system into trusting malicious requests and their associated payloads.

Security researchers first observed exploitation attempts in the wild starting around July 1, 2025. The attack is particularly dangerous because We see unauthenticated, meaning the adversary does not need a username or password to start the breach. Once the RCE is achieved, attackers typically move to steal cryptographic machine keys. This represents a critical step because it allows the adversary to forge authentication tokens, ensuring that even if the initial vulnerability is patched, they may still possess a “backdoor” into the environment.

The scale of the threat is significant. Reporting from Recorded Future indicates that the ToolShell exploit chain has position thousands of SharePoint servers worldwide at risk, with widespread campaigns being tracked by agencies such as the Canadian Centre for Cyber Security via the Cyber Centre.

Who is at Risk?

The vulnerability specifically affects on-premises installations. Organizations utilizing SharePoint Online (the cloud-based version) are generally not susceptible to this specific deserialization flaw in the ToolPane.aspx component. However, any organization running the following versions is at high risk:

• Microsoft SharePoint Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

The danger is amplified for organizations that have not maintained a rigorous patching schedule or those that expose their SharePoint servers directly to the public internet without a robust Web Application Firewall (WAF) or VPN requirement.

The Persistence Problem: Why Patching Isn’t Enough

One of the most alarming aspects of the ToolShell campaign is the focus on post-exploitation persistence. Because attackers prioritize the theft of machine keys, a simple software update may not be sufficient to evict a threat actor who has already compromised the system.

If an attacker has successfully harvested the server’s cryptographic keys, they can create their own valid session tokens. So they can continue to access the server and its data as a legitimate administrator even after the CVE-2025-53770 vulnerability is closed. This “post-patch” exploitation has been observed in several instances, with some reports attributing these persistent campaigns to state-backed actors seeking long-term espionage capabilities according to Daily Security Review.

To fully remediate a ToolShell infection, administrators must not only apply the official Microsoft security updates but also rotate the machine keys and audit all active sessions and administrative accounts for unauthorized additions.

How to Protect Your SharePoint Environment

Given the critical nature of this RCE threat, security professionals should treat ToolShell as a top-priority emergency. The following steps are recommended for immediate risk mitigation:

1. Immediate Patching

Apply all current security updates for SharePoint Server. Microsoft has released patches specifically addressing the deserialization flaws. Ensure that all servers in the farm are updated simultaneously to prevent “version skew” vulnerabilities.

2. Rotate Machine Keys

If there is any suspicion of a breach—or if the server was unpatched while exposed to the internet—administrators must rotate the SharePoint machine keys. This invalidates any tokens the attacker may have forged using stolen keys, effectively cutting off their persistent access.

3. Implement Layered Defenses

Relying solely on patches is risky. Organizations should implement a “Defense in Depth” strategy:

• Network Segmentation: Ensure SharePoint servers are not directly accessible from the open web. Use a VPN or Zero Trust Network Access (ZTNA) for remote employees.
• WAF Configuration: Deploy a Web Application Firewall with signatures specifically designed to detect and block ToolShell-related payloads and unusual requests to ToolPane.aspx.
• Endpoint Detection and Response (EDR): Monitor for unusual process spawns from the SharePoint service account, such as the launch of cmd.exe or powershell.exe, which are common indicators of a web shell deployment.

4. Audit for Indicators of Compromise (IoCs)

Search server logs for unexpected requests to ToolPane.aspx and check for the creation of unfamiliar .aspx files in the web directories, which often signal the presence of a web shell used for remote command execution.

As threat actors continue to refine their methods, the ToolShell campaign serves as a reminder that on-premises legacy software remains a primary target for high-impact attacks. The next critical checkpoint for administrators will be the continued release of updated IoC lists from security vendors and Microsoft’s ongoing guidance on key rotation and forensic recovery.

Do you have a security question about your SharePoint configuration or a tip regarding recent activity in your environment? Share your thoughts in the comments below or contact our tech desk.