CVE-2025-53760: SSRF in Microsoft SharePoint Enterprise Server

The SSRF vulnerability in SharePoint Enterprise Server allows an attacker who has authenticated access to the system to craft malicious requests that appear to originate from the SharePoint server itself. This can be exploited to access internal resources that are otherwise protected, such as databases, APIs, or other internal services. Successful exploitation could lead to data exfiltration, privilege escalation, and potentially complete compromise of the affected SharePoint environment. The attacker could potentially use SharePoint as a springboard to launch attacks against other systems on the network, expanding the blast radius beyond just the SharePoint server itself. While the vulnerability requires authentication, the potential for privilege escalation makes it a significant security risk.

1. Reserved2025-07-09
2. Published2025-08-12
3. Modified2026-02-13
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-53760 is to upgrade Microsoft SharePoint Enterprise Server to version 16.0.18526.20518 or later. If immediate upgrading is not possible, consider implementing network segmentation to restrict SharePoint's access to internal resources. Implement strict input validation and output encoding within SharePoint applications to prevent malicious requests. Review and strengthen authentication mechanisms to limit the potential for attackers to gain initial access. Monitor SharePoint logs for suspicious activity, particularly requests to unusual or internal endpoints. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to block malicious requests.