Cato CTRL™ Threat Brief: “ToolShell” Exploit Targeting Microsoft SharePoint Vulnerabilities

Executive Summary  On July 22, 2025, Microsoft published an overview of a series of critical vulnerabilities affecting Microsoft SharePoint Server ( CVE-2025-49704 , CVE-2025-49706 , CVE-2025-53770 , and CVE-2025-53771 ). These vulnerabilities opened a dangerous window for threat actors to gain access to internal resources, execute code remotely, and take over SharePoint deployments. According to Microsoft, it has “observed two named Chinese nation-state actors, Linen…