Information Security Bulletin CVE-2025-53770 – SharePoint Remote Code Execution Vulnerability

July 22, 2025

A critical security vulnerability was publicly disclosed in Microsoft SharePoint on July 18, 2025, identified as CVE‑2025‑53770. This vulnerability allows unauthenticated remote code execution on on-premises SharePoint servers, posing a severe risk to confidentiality, integrity, and availability of affected systems. Microsoft has confirmed that this vulnerability is being actively exploited in the wild.

Background:

CVE‑2025‑53770 is a zero-day vulnerability affecting SharePoint Server Subscription Edition, SharePoint 2019, and SharePoint 2016 (with patches for 2016 still in progress). The vulnerability arises from improper handling of certain server-side inputs, allowing attackers to execute arbitrary code without authentication. It has been weaponized as part of a broader exploit chain in targeted attacks.

SharePoint Online (Microsoft 365) is not affected by this vulnerability.

Actions: 

Everbridge does not operate any on-premises SharePoint servers. All of our SharePoint usage is via SharePoint Online (SaaS), which is not impacted by CVE‑2025‑53770.

As a result, no Everbridge systems are vulnerable to this exploit.

If you have any questions, please open a support request via the Everbridge Support Center or contact Everbridge Technical Support.