CVE-2025-59237 Overview
CVE-2025-59237 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint. The flaw allows an authorized attacker to execute arbitrary code over a network against affected SharePoint Server installations. Microsoft published advisory details through the Microsoft Security Response Center.
The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Exploitation requires low privileges and no user interaction, making post-authentication attacks straightforward for adversaries who obtain valid SharePoint credentials.
Critical Impact
An authenticated attacker can achieve remote code execution on the SharePoint server, leading to compromise of confidentiality, integrity, and availability of hosted content and the underlying host.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2025-10-14 - CVE-2025-59237 published to NVD
- 2025-10-28 - Last updated in NVD database
Technical Details for CVE-2025-59237
Vulnerability Analysis
The vulnerability stems from insecure deserialization of attacker-controlled data within Microsoft Office SharePoint. SharePoint deserializes data structures supplied through authenticated request paths without sufficient type or integrity validation. An authorized user can submit a crafted serialized payload that instantiates dangerous .NET gadget chains during deserialization.
When the server reconstructs the malicious object graph, attacker-controlled methods execute in the SharePoint worker process context. This grants the attacker code execution with the privileges of the SharePoint application pool identity. Network-reachable endpoints make this exploitable from any client that can authenticate to the SharePoint farm.
The Exploit Prediction Scoring System (EPSS) places this vulnerability in the 80.5th percentile, indicating elevated likelihood of exploitation activity relative to most published CVEs.
Root Cause
The root cause is unsafe handling of serialized .NET objects in SharePoint request processing. SharePoint accepts serialized input and invokes deserialization routines without restricting allowed types through a SerializationBinder or equivalent allowlist. This pattern, classified under [CWE-502], permits gadget chain abuse using types already present in the SharePoint and .NET runtime assemblies.
Attack Vector
The attack vector is network-based and requires the attacker to hold a valid, low-privileged SharePoint account. After authenticating, the attacker submits a serialized payload to a vulnerable SharePoint endpoint. During deserialization, the constructed gadget chain triggers command execution under the SharePoint service account, enabling lateral movement, data theft, or persistence on the SharePoint farm.
No verified public proof-of-concept code is currently available. See the Microsoft Security Update Guide CVE-2025-59237 for vendor technical details.
Detection Methods for CVE-2025-59237
Indicators of Compromise
- Unexpected child processes spawned by w3wp.exe running under the SharePoint application pool identity, such as cmd.exe, powershell.exe, or rundll32.exe.
- Anomalous outbound network connections originating from SharePoint web front-end servers to untrusted destinations.
- New or modified .aspx files in SharePoint web directories such as %ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS.
- IIS log entries showing authenticated POST requests with abnormally large payloads to SharePoint handler URLs.
Detection Strategies
- Hunt for serialized .NET gadget signatures, including base64-encoded TypeConfuseDelegate, ObjectDataProvider, or BinaryFormatter markers, in IIS request bodies and ULS logs.
- Correlate authenticated SharePoint sessions with subsequent process creation events to identify low-privileged accounts triggering code execution.
- Apply behavioral rules that flag w3wp.exe launching script interpreters or LOLBins.
Monitoring Recommendations
- Forward SharePoint ULS logs, IIS logs, and Windows process creation events (Event ID 4688) to a centralized analytics platform.
- Alert on file integrity changes within SharePoint LAYOUTS and _app_bin directories.
- Monitor outbound traffic from SharePoint servers and baseline expected destinations to surface command-and-control activity.
How to Mitigate CVE-2025-59237
Immediate Actions Required
- Apply the Microsoft security update for CVE-2025-59237 to all SharePoint Server Subscription Edition, 2019, and 2016 Enterprise installations.
- Audit SharePoint accounts and revoke unnecessary access, prioritizing removal of dormant or low-privileged accounts that could be abused.
- Rotate credentials for SharePoint service accounts and farm administrators if compromise is suspected.
- Restrict SharePoint web front-end exposure to trusted networks where business requirements allow.
Patch Information
Microsoft has released security updates addressing CVE-2025-59237. Administrators should consult the Microsoft Security Update Guide CVE-2025-59237 for the specific KB articles and binary versions corresponding to each affected SharePoint Server edition, then deploy through standard patching processes.
Workarounds
- No vendor-supplied workaround replaces patching. Microsoft recommends installing the security update as the authoritative mitigation.
- Where immediate patching is not feasible, place SharePoint behind authenticating reverse proxies and enforce multi-factor authentication to raise the bar for the required authenticated access.
- Enable AMSI integration for SharePoint Server and ensure antimalware scanning is active on the SharePoint farm.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
