What is ToolShell?

SharePoint Server is Microsoft's on-premises collaboration platform, built on ASP.NET and Internet Information Services (IIS). ToolShell chains two flaws:

• An authentication bypass (CVE-2025-49706, then its bypass CVE-2025-53771). A request to /_layouts/15/ToolPane.aspx with a Referer header pointing at the sign-out page was treated as trusted, so the endpoint ran without a login.
• Deserialization of untrusted data (CVE-2025-49704, then its bypass CVE-2025-53770). ToolPane processed attacker-supplied data in a way that rebuilt .NET objects from it, a classic insecure deserialization path to code execution.

The original pair was demonstrated at Pwn2Own Berlin in May 2025 and patched on July 8, 2025. Attackers found variants that slipped past those patches within days, and Microsoft issued emergency updates on July 20 and 21, 2025 under the new CVE numbers. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog, and MITRE tracks the activity as campaign C0058.

Shown for defensive context, the campaign followed a consistent pattern:

• A crafted POST to /_layouts/15/ToolPane.aspx?DisplayMode=Edit with Referer: /_layouts/SignOut.aspx, carrying the deserialization payload.
• A [web shell](/learn/persistence/what-is-a-web-shell) written as spinstall0.aspx (and variants) in the _layouts/15/ folder.
• Machine key theft. The shell read the ASP.NET ValidationKey and DecryptionKey from web.config. With those keys an attacker can sign their own __VIEWSTATE payloads, which SharePoint then deserializes as trusted, so they keep code execution even after the bug is patched.
• Follow-on activity: credential theft with Mimikatz, lateral movement with PsExec and Impacket, disabling Microsoft Defender and, in some intrusions, ransomware.

Espionage and ransomware groups both used the chain against finance, education, energy, healthcare and government targets.

• Install the July 2025 SharePoint security updates or later for SharePoint Server 2016, 2019 and Subscription Edition. Out-of-support versions such as SharePoint 2013 get no fix.
• Rotate the ASP.NET machine keys after patching, with Update-SPMachineKey in PowerShell or the Machine Key Rotation timer job, then restart IIS on every server in the farm.
• Turn on AMSI integration (the Antimalware Scan Interface, Full Mode) with an endpoint protection product, which Microsoft recommended as a compensating control.
• Hunt for spinstall0.aspx or other unexpected .aspx files in _layouts, POSTs to ToolPane.aspx with a sign-out referer in IIS logs, and w3wp.exe spawning cmd.exe or powershell.exe.
• Reduce exposure. Do not publish on-premises SharePoint directly to the internet without an authenticating gateway in front of it.