CVE-2025-53771: exploitation status and patch state

CVE-2025-53771 · CVSS 6.5 MEDIUM · EPSS 99.9% · patch available

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Is CVE-2025-53771 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 99.9%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

• Microsoft · Microsoft SharePoint Enterprise Server 2016 · >= 16.0.0, < 16.0.5513.1001
• Microsoft · Microsoft SharePoint Server 2019 · >= 16.0.0, < 16.0.10417.20037
• Microsoft · Microsoft SharePoint Server Subscription Edition · >= 16.0.0, < 16.0.18526.20508

Is there a patch?

Yes. Update to one of these or later:

From Microsoft's CVE record · Microsoft advisory

What PlainSec published about CVE-2025-53771

• Storm-2603's SharePoint foothold hid in IIS memory (2026-11-06)

Primary sources

• NVD record
• Microsoft advisory
• Metasploit: exploit/windows/http/sharepoint_toolpane_rce
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-11-05.