SharePoint ToolShell (CVE-2025-53770 / CVE-2025-53771): on-premises SharePoint Server exploited without authentication and machine keys stolen. Is patching enough, or do I need to rotate machine keys?

What it is: ToolShell is the July 2025 SharePoint Server zero-day chain (CVE-2025-53770, with the related CVE-2025-53771) that allowed unauthenticated remote code execution on on-premises SharePoint. Attackers used it to steal the servers' ASP.NET machine keys, which let them keep forging trusted requests even after the bug was patched. It was exploited at large scale against governments and companies and added to CISA's Known Exploited Vulnerabilities catalog. SharePoint Online (Microsoft 365) was not affected. Am I affected: - On-premises SharePoint Server Subscription Edition, 2019 and 2016 without the July 2025 emergency updates (KB5002768, KB5002754, and KB5002760 / KB5002759 for 2016) or a later cumulative update. - SharePoint 2010 and 2013 are out of support and got no fix: take them off the internet and migrate. - Check the installed build in Central Administration (Upgrade and Migration, Check product and patch installation status). Fix: 1. Install the July 2025 security update or any later SharePoint cumulative update for your version on every server in the farm, and run the configuration wizard. 2. Rotate the ASP.NET machine keys, because keys stolen before patching still work: in SharePoint Management Shell use Set-SPMachineKey and Update-SPMachineKey for each web application (or run the Machine Key Rotation timer job), then run iisreset on every SharePoint server. Patching without rotating leaves a stolen key valid. 3. Turn on the AMSI integration (Full Mode) with Microsoft Defender Antivirus or another AMSI-capable antivirus on all SharePoint servers. After: - Hunt for compromise from July 2025 onward: unexpected .aspx files in the LAYOUTS directories (Microsoft named spinstall0.aspx among the indicators), w3wp.exe spawning cmd.exe or PowerShell, and outbound connections from SharePoint servers. - If you find signs of compromise, treat the farm as breached: isolate it, rotate keys again after cleanup, reset credentials of service and admin accounts, and follow your incident response process. Sources: https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-patches-for-sharepoint-rce-flaws-exploited-in-attacks/ https://arcticwolf.com/resources/blog/cve-2025-53770