bluefire-redteam-cybersecurity/bluefire-sharepoint-cve-2025-53770Automated detection, assessment, and remediation toolkit for SharePoint CVE-2025-53770 (CVSS 9.8). Includes PowerShell scripts to verify patch status, scan for IoCs, enable AMSI, and rotate MachineKeys.
This open-source toolkit provides security teams with battle-tested scripts to detect, assess, and remediate the critical SharePoint zero-day vulnerability CVE-2025-53770 (CVSS 9.8) — currently being exploited in the wild.
Maintained by Bluefire Redteam, a global offensive security firm.
Once exploited, attackers can:
While Microsoft provides security updates and mitigation guidance, many organizations still struggle with operationalizing those instructions. This toolkit from Bluefire Redteam automates the detection of vulnerable SharePoint builds, verifies patch status, scans for indicators of compromise (IoCs), and performs critical actions like enabling AMSI and rotating MachineKeys — steps that Microsoft recommends but does not automate. It’s designed to help security teams quickly assess and harden their environments with minimal effort and zero guesswork, especially in large or hybrid deployments.
This repository is maintained by Bluefire Redteam for informational and operational use only.
❗ Please do not fork, modify, or create derivative scripts under this repository.
If you need a custom version, contact our team directly via bluefire-redteam.com/contact. Unauthorized modifications may introduce security risks and are not supported by Bluefire Redteam.
git clone https://github.com/bluefireredteam/bluefire-sharepoint-cve-2025-53770.git
cd bluefire-sharepoint-cve-2025-53770
.\scripts\detect-vulnerability.ps1
This script:
spinstall0.aspx, encoded PowerShell, suspicious w3wp.exe behavior).\scripts\remediate-vulnerability.ps1
This script:
bash ./scripts/hybrid-ioc-scan.sh
Useful for:
Need help analyzing your environment or running this toolkit at scale?
This project is licensed under the MIT License.
SharePoint sits at the core of many enterprise intranets, workflows, and DevOps pipelines. CVE-2025-53770 allows unauthenticated attackers to take full control of these environments with minimal friction. This toolkit gives defenders a reliable first line of defense — backed by a red team’s real-world testing.