# SharePoint ToolShell: patch on-premises servers, turn on AMSI, rotate ASP.NET machine keys and restart IIS

> CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.

- Canonical URL: https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-19T00:28:02+00:00
- Modified: 2026-10-19T01:55:07+00:00
- Last reviewed by DSE: 2026-10-19
- Resource type: Playbook
- DSE priority: Important
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.

## Potentially affected

Organizations running SharePoint Server on premises, especially internet-facing farms, and the administrators and providers who maintain them.

## DSE recommendation

DSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise.

## Article

CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.

## Source facts

CISA’s [alert on SharePoint exploitation](https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities), last revised August 6, 2025, describes active exploitation of a spoofing and remote code execution chain, CVE-2025-49706 and CVE-2025-49704, publicly reported as ToolShell, that lets attackers fully access SharePoint content, including file systems and internal configurations, and execute code over the network on on-premises servers. It says .dll payloads have been observed alongside webshells, that attackers have also distributed Warlock ransomware, and that CVE-2025-53771 and CVE-2025-53770 are patch bypasses for those two flaws.

CISA recommends applying Microsoft’s security updates, configuring the Antimalware Scan Interface in SharePoint with antivirus on all SharePoint servers, deploying EDR, and disconnecting public-facing servers from the internet if AMSI cannot be enabled. It says to rotate ASP.NET machine keys, apply the update, rotate the keys again and restart IIS with iisreset.exe, and warns that malicious module entries left in applicationHost.config and web.config will persist and reload when IIS restarts.

It also says to disconnect public-facing SharePoint versions that have reached end of life or end of service, to monitor for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit and requests with the referrer /_layouts/SignOut.aspx, and to audit and minimize layout and admin privileges.

## Applicability

Use this for SharePoint Server installed on premises or on self-managed servers; CISA’s alert concerns on-premises SharePoint servers. Follow Microsoft’s advisories for the exact updates that apply to each SharePoint version.

## DSE recommendation

DSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise. Remove SharePoint from direct internet exposure where possible, check IIS configuration files for unknown modules, review web logs for the ToolPane and SignOut patterns, and plan replacement of any server past end of support.

## Verification

Record each farm’s build number against Microsoft’s fixed versions, confirm AMSI status and the machine key rotation date, and keep the log review results with the incident file.

## Official reference

[CISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities](https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities). Reviewed October 19, 2026.

## Primary reference

- Name: CISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities
- Authority: Cybersecurity and Infrastructure Security Agency
- URL: https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “SharePoint ToolShell: patch on-premises servers, turn on AMSI, rotate ASP.NET machine keys and restart IIS,” DSE Security, https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.