Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A serious new vulnerability (CVE-2025-53770, also known as “ToolShell”) is actively being exploited by cybercriminals to hack into on-premises Microsoft SharePoint Servers. The vulnerability, along with CVE-2025-53771 was discovered around July 18, 2025. Bitsight Research classifies CVE-2025-53770 as 10 out of 10 on our Dynamic Vulnerability Exploit (DVE) scale and CVE-2025-53771 as a 5.82 out of 10 indicating severe and moderate urgency respectively.

On July 19, 2025, Microsoft disclosed CVE-2025-53770, a critical zero-day Remote Code Execution (RCE) vulnerability. Assigned a CVSS 3.1 base score of 9.8 (Critical), the vulnerability affects SharePoint Server 2016, 2019, and the Subscription Edition, along with unsupported 2010 and 2013 versions. Cloudflare’s WAF Managed Rules now includes 2 emergency releases that mitigate these vulnerabilities for WAF customers.

We’re excited to announce a major Seemplicity release packed with new AI-driven features that help you fix faster, prioritize better, and streamline remediation at scale. This release introduces breakthrough capabilities that reduce noise, provide clarity, and eliminate bottlenecks between identifying risks and resolving them.

Starting on July 19th, 2025, an npm supply chain security incident has been attacking maintainers of popular open-source npm packages on the npm registry.

Today, we’re excited to announce a preview of the Model Context Protocol (MCP) Server for Nucleus. This marks an important step towards AI-native workflows for vulnerability and exposure management. Model Context Protocol (MCP) is an emerging industry standard enabling seamless integration between enterprise applications and AI models. Backed by leading organizations like OpenAI, Microsoft, and Google, MCP servers are quickly becoming the foundation for AI-enablement across the enterprise.

On July 19, 2025, Microsoft disclosed active exploitation of a zero-day vulnerability (CVE-2025-53770) affecting on-premises SharePoint Server instances. Originally, no patch was available for this vulnerability, but fixes were released late on the evening of July 20. CVE-2025-53770 is caused by the deserialization of untrusted data, allowing unauthenticated threat actors to execute code remotely over the network.

CrowdStrike is proud to be named a Strong Performer in The Forrester Wave: Unified Vulnerability Management Solutions, Q3 2025. We believe this recognition underscores the strength of CrowdStrike’s vision, the pace of our innovation, and the rapid adoption of CrowdStrike Falcon Exposure Management by customers transforming their vulnerability management, just 24 months after its launch.

Not long ago, “visibility” was the North Star of cybersecurity. If you could just see all your assets, vulnerabilities, and misconfigurations, you could manage the risk. But that logic doesn’t hold up anymore; not in a world where your infrastructure is scattered across multiple clouds, tied together by APIs you didn’t build, and partially run by vendors you barely know.

A newly disclosed zero-day vulnerability in Microsoft SharePoint Server — CVE-2025-53770 — is currently being exploited in the wild and poses a critical threat to organizations running on-premises SharePoint instances.