CVE-2025-53770

Microsoft SharePoint on-premises suffered a deserialization of untrusted data vulnerability allowing remote code execution, actively exploited in the wild and linked to ransomware.

An attacker could execute arbitrary code over a network by exploiting this deserialization flaw in SharePoint Server on-premises, which was actively exploited in the wild and linked to ransomware attacks. This failure matters to DIB organizations because it represents a critical, avoidable exposure where a known vulnerability was exploited before patching, directly impacting compliance with NIST 800-171 requirements for patch management and vulnerability mitigation. Organizations must ensure all SharePoint on-premises instances are patched immediately and monitor for similar exploitation patterns.

Shame score — A critical deserialization vulnerability was actively exploited in the wild and linked to ransomware, indicating severe negligence in patch management and vulnerability mitigation.