What you need to know
CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.
Potentially affected
Organizations running SharePoint Server on premises, especially internet-facing farms, and the administrators and providers who maintain them.
DSE recommendation
DSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise.
CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.
Source facts
CISA’s alert on SharePoint exploitation, last revised August 6, 2025, describes active exploitation of a spoofing and remote code execution chain, CVE-2025-49706 and CVE-2025-49704, publicly reported as ToolShell, that lets attackers fully access SharePoint content, including file systems and internal configurations, and execute code over the network on on-premises servers. It says .dll payloads have been observed alongside webshells, that attackers have also distributed Warlock ransomware, and that CVE-2025-53771 and CVE-2025-53770 are patch bypasses for those two flaws.
CISA recommends applying Microsoft’s security updates, configuring the Antimalware Scan Interface in SharePoint with antivirus on all SharePoint servers, deploying EDR, and disconnecting public-facing servers from the internet if AMSI cannot be enabled. It says to rotate ASP.NET machine keys, apply the update, rotate the keys again and restart IIS with iisreset.exe, and warns that malicious module entries left in applicationHost.config and web.config will persist and reload when IIS restarts.
It also says to disconnect public-facing SharePoint versions that have reached end of life or end of service, to monitor for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit and requests with the referrer /_layouts/SignOut.aspx, and to audit and minimize layout and admin privileges.
Applicability
Use this for SharePoint Server installed on premises or on self-managed servers; CISA’s alert concerns on-premises SharePoint servers. Follow Microsoft’s advisories for the exact updates that apply to each SharePoint version.
DSE recommendation
DSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise. Remove SharePoint from direct internet exposure where possible, check IIS configuration files for unknown modules, review web logs for the ToolPane and SignOut patterns, and plan replacement of any server past end of support.
Verification
Record each farm’s build number against Microsoft’s fixed versions, confirm AMSI status and the machine key rotation date, and keep the log review results with the incident file.
Official reference
CISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities. Reviewed October 19, 2026.
Review the official source
CISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities · Verified October 19, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE