Microsoft SharePoint ToolShell Exploit Attempt

The ToolShell exploit chain includes an authentication bypass vulnerability (CVE-2025-49706 or CVE-2025-53771) paired with a deserialization of untrusted data vulnerability (CVE-2025-49704 or CVE-2025-53770). An attacker sends an HTTP POST request with untrusted data to a vulnerable ToolPane.aspx endpoint. This endpoint deserializes the object passed in the POST request and runs malicious commands when the request is either authenticated or chained with an exploit of CVE-2025-49706 or CVE-2025-53771 to spoof the authentication. The attacker can attempt to install a malicious file that steals encryption keys, allowing the attacker to forge valid authentication tokens and later establish persistence or deploy malware.