Skip to main content

CISA issues Malware Analysis Report on SharePoint vulnerabilities

Source Decision Insights Coverage Published August 20, 2025 Companies 3
Human View Machine View

3 companies named across 8 categories, one of 90 articles referencing Microsoft. Previous coverage: Univers partners with Microsoft for AI energy solutions (Aug 2025).

Companies mentioned

CISA has issued a Malware Analysis Report detailing detection signatures and analysis of files linked to Microsoft SharePoint vulnerabilities.

Vulnerability Details

The report identifies several vulnerabilities: CVE-2025-49704, classified as CWE-94: Code Injection; CVE-2025-49706, described as CWE-287: Improper Authentication; CVE-2025-53770, relating to CWE-502: Deserialization of Untrusted Data; and CVE-2025-53771, also linked to CWE-287.

Malware Analysis and Exploit Chain

Cyber threat actors have utilized CVE-2025-49704 and CVE-2025-49706 in an exploit chain known as “ToolShell” to gain unauthorized access to SharePoint servers. CISA’s analysis included six files, encompassing two Dynamic Link Libraries, one key stealer, and three web shells, indicating that threat actors could misuse this malware to extract cryptographic keys and execute commands to exfiltrate data.

Recommendations and Resources

CISA has listed CVE-2025-49704 and CVE-2025-49706 in its Known Exploited Vulnerabilities (KEV) Catalog as of July 22 and July 20, 2025, respectively. Organizations are advised to utilize the Indicators of Compromise (IOC) and detection signatures provided in the MAR to identify potential malware incursions.

For additional insights and downloadable files associated with the malware, including JSON and YAML formats for detection rules, consult the report on CISA's website.

Conclusion

This Malware Analysis Report offers crucial information on recent vulnerabilities affecting Microsoft SharePoint. It serves as a valuable resource for IT security professionals in mitigating potential threats.

Blog post, originally published by Summary by StringerAI - Source: Cybersecurity and Infrastructure Security Agency (CISA) at decisioninsights.ai.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-malware-analysis-report-on-sharepoint-vulnerabilities/",
        "name": "CISA issues Malware Analysis Report on SharePoint vulnerabilities",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-malware-analysis-report-on-sharepoint-vulnerabilities/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
      "name": "Department of Homeland Security"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
      "@type": "Person",
      "name": "Decision Insights Coverage",
      "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
    },
    "dateModified": "2026-08-23T12:55:20-06:00",
    "datePublished": "2025-08-20T15:39:49-06:00",
    "description": "CISA's Malware Analysis Report outlines detection signatures for Microsoft SharePoint vulnerabilities and encourages use of IOCs.",
    "headline": "CISA issues Malware Analysis Report on SharePoint vulnerabilities",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Summary by StringerAI - Source: Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      "url": "https://decisioninsights.ai/advisory/cisa-releases-malware-analysis-report-on-sharepoint-vulnerabilities/2025/08/"
    },
    "keywords": [
      "Exploit",
      "Indicators of Compromise",
      "Known Exploited Vulnerabilities",
      "Malware",
      "Malware Analysis",
      "Threats",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-malware-analysis-report-on-sharepoint-vulnerabilities/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
        "name": "Microsoft"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
    "@type": "Person",
    "description": "Blog posts, podcasts, and video analysis from across the industry, condensed into short, sourced summaries. Produced under our Standards & Methodology.",
    "name": "Decision Insights Coverage",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
  }
]

Is this your company? Get structured data for your own pages