{"schema":"vulnpedia.research/1","cve":"CVE-2025-53771","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771","tags":["vendor-advisory","patch","Vendor Advisory"],"source":"mitre","sourceId":"microsoft","modified":"2026-02-13T19:07:03.835Z","origins":[{"source":"mitre","sourceId":"microsoft","modified":"2026-02-13T19:07:03.835Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771"},{"source":"nvd","sourceId":"CVE-2025-53771","modified":"2026-06-17T09:38:51.820","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771"}]},{"url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/","tags":["Press/Media Coverage"],"source":"mitre","sourceId":"CVE","modified":"2025-07-20T23:40:49.866Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2025-07-20T23:40:49.866Z","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/"},{"source":"nvd","sourceId":"CVE-2025-53771","modified":"2026-06-17T09:38:51.820","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/"}]},{"source":"euvd","sourceId":"EUVD-2025-22040","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22040","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2025-22040","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22040"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://research.eye.security/sharepoint-under-siege/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://research.eye.security/sharepoint-under-siege/"}]},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities"}]},{"url":"https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/"}]},{"url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"}]},{"url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-blocks-sharepoint-zero-day-exploitation/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-blocks-sharepoint-zero-day-exploitation/"}]},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"}]},{"url":"https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k"}]},{"url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day"}]},{"url":"https://www.bitsight.com/blog/toolshell-threat-brief-sharepoint-rce-vulnerabilities-cve-2025-53770-53771-explained","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.bitsight.com/blog/toolshell-threat-brief-sharepoint-rce-vulnerabilities-cve-2025-53770-53771-explained"}]},{"url":"https://www.logpoint.com/en/blog/toolshell-when-sharepoint-becomes-a-gateway-to-rce/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.logpoint.com/en/blog/toolshell-when-sharepoint-becomes-a-gateway-to-rce/"}]},{"url":"https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html"}]},{"url":"https://www.cybereason.com/blog/two-sharepoint-on-prem-vulnerabilities","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.cybereason.com/blog/two-sharepoint-on-prem-vulnerabilities"}]},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/in-the-wild-exploitation-of-cve-2025-53770-and-cve-2025-53771-technical-details-and-mitigation-strategies/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/in-the-wild-exploitation-of-cve-2025-53770-and-cve-2025-53771-technical-details-and-mitigation-strategies/"}]},{"url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"}]},{"url":"https://www.fortinet.com/blog/threat-research/inside-the-toolshell-campaign","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.fortinet.com/blog/threat-research/inside-the-toolshell-campaign"}]},{"url":"https://www.splunk.com/en_us/blog/security/sharepoint-exploits-and-the-hidden-threat-of-iis-module-persistence.html","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.splunk.com/en_us/blog/security/sharepoint-exploits-and-the-hidden-threat-of-iis-module-persistence.html"}]},{"url":"https://mp.weixin.qq.com/s/h6_ijQAHhq4tersaBE5fXQ","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://mp.weixin.qq.com/s/h6_ijQAHhq4tersaBE5fXQ"}]},{"url":"https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/"}]},{"url":"https://falconfeeds.io/blogs/echoes-of-the-exploit-old-vulnerabilities-threat-actor-campaigns","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://falconfeeds.io/blogs/echoes-of-the-exploit-old-vulnerabilities-threat-actor-campaigns"}]},{"url":"https://www.blackfog.com/warlock-ransomware-blackfog-in-action/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.blackfog.com/warlock-ransomware-blackfog-in-action/"}]},{"url":"https://isc.sans.edu/diary/rss/32174","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://isc.sans.edu/diary/rss/32174"}]},{"url":"https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/"}]},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/echoes-in-the-shell-legacy-tooling-behind-ongoing-sharepoint-toolshell-exploitation/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/echoes-in-the-shell-legacy-tooling-behind-ongoing-sharepoint-toolshell-exploitation/"}]},{"url":"https://www.cisa.gov/news-events/analysis-reports/ar25-218a","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-218a"}]},{"url":"https://www.cisa.gov/sites/default/files/2025-08/MAR-251132.c1.v1.CLEAR_.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/2025-08/MAR-251132.c1.v1.CLEAR_.pdf"}]},{"url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf"}]},{"url":"https://cyble.com/blog/ransomware-groups-july-2025-attacks/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://cyble.com/blog/ransomware-groups-july-2025-attacks/"}]},{"url":"https://www.attackiq.com/2025/08/27/emulating-warlock-ransomware/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.attackiq.com/2025/08/27/emulating-warlock-ransomware/"}]},{"url":"https://falconfeeds.io/blogs/china-cyber-campaign-critical-infrastructure-2024-2025","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://falconfeeds.io/blogs/china-cyber-campaign-critical-infrastructure-2024-2025"}]},{"url":"https://news.sophos.com/en-us/2025/09/17/gold-salems-warlock-operation-joins-busy-ransomware-landscape/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://news.sophos.com/en-us/2025/09/17/gold-salems-warlock-operation-joins-busy-ransomware-landscape/"}]},{"url":"https://www.sophos.com/en-us/blog/gold-salems-warlock-operation-joins-busy-ransomware-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.sophos.com/en-us/blog/gold-salems-warlock-operation-joins-busy-ransomware-landscape"}]},{"url":"https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/storm-2603-targeting-sharepoint-vulnerabilities-and-critical-infrastructure-worldwide","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/storm-2603-targeting-sharepoint-vulnerabilities-and-critical-infrastructure-worldwide"}]},{"url":"https://blog.talosintelligence.com/ir-trends-q3-2025/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/"}]},{"url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report"}]},{"url":"https://hybrid-analysis.blogspot.com/2025/10/a-deep-dive-into-warlock-ransomware.html","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://hybrid-analysis.blogspot.com/2025/10/a-deep-dive-into-warlock-ransomware.html"}]},{"url":"https://www.ptsecurity.com/research/analytics/results-of-incident-investigation-and-retrospective-analysis-projects-2024-2025/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.ptsecurity.com/research/analytics/results-of-incident-investigation-and-retrospective-analysis-projects-2024-2025/"}]},{"url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/"}]},{"url":"https://isc.sans.edu/diary/rss/32524","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://isc.sans.edu/diary/rss/32524"}]},{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/"}]},{"url":"https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm"}]},{"url":"https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/"}]},{"url":"https://hs-45734016.f.hubspotemail.net/hubfs/45734016/Global%20Threat%20Report%2c%20End%20of%202025.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://hs-45734016.f.hubspotemail.net/hubfs/45734016/Global%20Threat%20Report%2c%20End%20of%202025.pdf"}]},{"url":"https://blog.polyswarm.io/polyswarms-2025-year-in-review","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://blog.polyswarm.io/polyswarms-2025-year-in-review"}]},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025"}]},{"url":"https://medium.com/@nshcthreatrecon/vulnerability-exploitation-landscape-2025-trends-and-2026-outlook-6e375cfc8861","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://medium.com/@nshcthreatrecon/vulnerability-exploitation-landscape-2025-trends-and-2026-outlook-6e375cfc8861"}]},{"url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026"}]},{"url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf"}]},{"url":"https://resources.dataminr.com/runtime/content/tev0mnMKQzuJTxST","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://resources.dataminr.com/runtime/content/tev0mnMKQzuJTxST"}]},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report"}]},{"url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025"}]},{"url":"https://medium.com/@nshcthreatrecon/2025-global-cyber-threat-landscape-dd0da508b433","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://medium.com/@nshcthreatrecon/2025-global-cyber-threat-landscape-dd0da508b433"}]},{"url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf"}]},{"url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa"}]},{"url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf"}]},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/"}]},{"url":"https://resource.redcanary.com/rs/003-YRU-314/images/2026-ThreatDetectionReport_RedCanary.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://resource.redcanary.com/rs/003-YRU-314/images/2026-ThreatDetectionReport_RedCanary.pdf"}]},{"url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf"}]},{"url":"https://www.gstatic.com/security-marketing/m-trends-2026-en.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.gstatic.com/security-marketing/m-trends-2026-en.pdf"}]},{"url":"https://eurepoc.eu/wp-content/uploads/2026/02/EuRepoC-Cyber-Activity-Balance-2025.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://eurepoc.eu/wp-content/uploads/2026/02/EuRepoC-Cyber-Activity-Balance-2025.pdf"}]},{"url":"https://engage.cognyte.com/s/9a9d013a/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://engage.cognyte.com/s/9a9d013a/"}]},{"url":"https://www.ussc.ru/upload/files/%D0%9E%D1%82%D1%87%D0%B5%D1%82%20SOC.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.ussc.ru/upload/files/%D0%9E%D1%82%D1%87%D0%B5%D1%82%20SOC.pdf"}]},{"url":"https://falconfeeds.io/blogs/threat-actors-2026-emerging-groups-every-ciso-should-watch/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://falconfeeds.io/blogs/threat-actors-2026-emerging-groups-every-ciso-should-watch/"}]},{"url":"https://medium.com/s2wblog/ransomware-landscape-in-h1-2026-statistics-and-key-issues-f15683e233cd","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://medium.com/s2wblog/ransomware-landscape-in-h1-2026-statistics-and-key-issues-f15683e233cd"}]},{"url":"https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure"}]},{"url":"https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[{"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb","source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","description":"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)","modified":"2026-06-02 10:32:30 +0000","kind":"metasploit","verification":"catalogued","origins":[{"source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"},{"source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","modified":"2026-06-02 10:32:30 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"}],"tags":[]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2025-07-18T00:00:00Z","modified":"2025-07-18T00:00:00Z","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Known","reportedByVulncheckCanaries":false,"vendorProject":"Microsoft","product":"SharePoint","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://research.eye.security/sharepoint-under-siege/","dateAdded":"2025-07-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://research.eye.security/sharepoint-under-siege/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities","dateAdded":"2025-07-21T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-blocks-sharepoint-zero-day-exploitation/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day","dateAdded":"2025-07-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.bitsight.com/blog/toolshell-threat-brief-sharepoint-rce-vulnerabilities-cve-2025-53770-53771-explained"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.logpoint.com/en/blog/toolshell-when-sharepoint-becomes-a-gateway-to-rce/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cybereason.com/blog/two-sharepoint-on-prem-vulnerabilities","dateAdded":"2025-07-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.cybereason.com/blog/two-sharepoint-on-prem-vulnerabilities"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/in-the-wild-exploitation-of-cve-2025-53770-and-cve-2025-53771-technical-details-and-mitigation-strategies/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/","dateAdded":"2025-07-24T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.fortinet.com/blog/threat-research/inside-the-toolshell-campaign","dateAdded":"2025-07-25T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.fortinet.com/blog/threat-research/inside-the-toolshell-campaign"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.splunk.com/en_us/blog/security/sharepoint-exploits-and-the-hidden-threat-of-iis-module-persistence.html"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://mp.weixin.qq.com/s/h6_ijQAHhq4tersaBE5fXQ","dateAdded":"2025-07-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://mp.weixin.qq.com/s/h6_ijQAHhq4tersaBE5fXQ"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/","dateAdded":"2025-07-31T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://falconfeeds.io/blogs/echoes-of-the-exploit-old-vulnerabilities-threat-actor-campaigns","dateAdded":"2025-08-04T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://falconfeeds.io/blogs/echoes-of-the-exploit-old-vulnerabilities-threat-actor-campaigns"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.blackfog.com/warlock-ransomware-blackfog-in-action/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://isc.sans.edu/diary/rss/32174","dateAdded":"2025-08-05T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://isc.sans.edu/diary/rss/32174"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/echoes-in-the-shell-legacy-tooling-behind-ongoing-sharepoint-toolshell-exploitation/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-218a","dateAdded":"2025-08-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-218a"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.cisa.gov/sites/default/files/2025-08/MAR-251132.c1.v1.CLEAR_.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","dateAdded":"2025-08-12T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://cyble.com/blog/ransomware-groups-july-2025-attacks/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.attackiq.com/2025/08/27/emulating-warlock-ransomware/","dateAdded":"2025-08-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.attackiq.com/2025/08/27/emulating-warlock-ransomware/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://falconfeeds.io/blogs/china-cyber-campaign-critical-infrastructure-2024-2025","dateAdded":"2025-08-21T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://falconfeeds.io/blogs/china-cyber-campaign-critical-infrastructure-2024-2025"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://news.sophos.com/en-us/2025/09/17/gold-salems-warlock-operation-joins-busy-ransomware-landscape/","dateAdded":"2025-09-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://news.sophos.com/en-us/2025/09/17/gold-salems-warlock-operation-joins-busy-ransomware-landscape/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.sophos.com/en-us/blog/gold-salems-warlock-operation-joins-busy-ransomware-landscape"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/storm-2603-targeting-sharepoint-vulnerabilities-and-critical-infrastructure-worldwide"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/","dateAdded":"2025-10-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report","dateAdded":"2025-10-29T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://hybrid-analysis.blogspot.com/2025/10/a-deep-dive-into-warlock-ransomware.html","dateAdded":"2025-10-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://hybrid-analysis.blogspot.com/2025/10/a-deep-dive-into-warlock-ransomware.html"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.ptsecurity.com/research/analytics/results-of-incident-investigation-and-retrospective-analysis-projects-2024-2025/","dateAdded":"2025-11-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.ptsecurity.com/research/analytics/results-of-incident-investigation-and-retrospective-analysis-projects-2024-2025/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/","dateAdded":"2025-12-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://isc.sans.edu/diary/rss/32524","dateAdded":"2025-12-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://isc.sans.edu/diary/rss/32524"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/","dateAdded":"2025-12-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/","dateAdded":"2025-12-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://hs-45734016.f.hubspotemail.net/hubfs/45734016/Global%20Threat%20Report%2c%20End%20of%202025.pdf","dateAdded":"2025-12-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://hs-45734016.f.hubspotemail.net/hubfs/45734016/Global%20Threat%20Report%2c%20End%20of%202025.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.polyswarm.io/polyswarms-2025-year-in-review","dateAdded":"2026-01-05T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://blog.polyswarm.io/polyswarms-2025-year-in-review"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","dateAdded":"2026-01-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@nshcthreatrecon/vulnerability-exploitation-landscape-2025-trends-and-2026-outlook-6e375cfc8861","dateAdded":"2026-01-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://medium.com/@nshcthreatrecon/vulnerability-exploitation-landscape-2025-trends-and-2026-outlook-6e375cfc8861"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026","dateAdded":"2026-01-28T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf","dateAdded":"2026-02-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://resources.dataminr.com/runtime/content/tev0mnMKQzuJTxST","dateAdded":"2026-02-19T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://resources.dataminr.com/runtime/content/tev0mnMKQzuJTxST"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","dateAdded":"2026-02-25T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025","dateAdded":"2026-03-05T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@nshcthreatrecon/2025-global-cyber-threat-landscape-dd0da508b433","dateAdded":"2026-03-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://medium.com/@nshcthreatrecon/2025-global-cyber-threat-landscape-dd0da508b433"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf","dateAdded":"2026-03-09T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa","dateAdded":"2026-03-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf","dateAdded":"2026-03-13T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/","dateAdded":"2026-03-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://resource.redcanary.com/rs/003-YRU-314/images/2026-ThreatDetectionReport_RedCanary.pdf","dateAdded":"2026-03-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://resource.redcanary.com/rs/003-YRU-314/images/2026-ThreatDetectionReport_RedCanary.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf","dateAdded":"2026-03-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf"},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.gstatic.com/security-marketing/m-trends-2026-en.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://eurepoc.eu/wp-content/uploads/2026/02/EuRepoC-Cyber-Activity-Balance-2025.pdf","dateAdded":"2026-04-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://eurepoc.eu/wp-content/uploads/2026/02/EuRepoC-Cyber-Activity-Balance-2025.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://engage.cognyte.com/s/9a9d013a/","dateAdded":"2026-05-24T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://engage.cognyte.com/s/9a9d013a/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.ussc.ru/upload/files/%D0%9E%D1%82%D1%87%D0%B5%D1%82%20SOC.pdf","dateAdded":"2026-06-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.ussc.ru/upload/files/%D0%9E%D1%82%D1%87%D0%B5%D1%82%20SOC.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://falconfeeds.io/blogs/threat-actors-2026-emerging-groups-every-ciso-should-watch/","dateAdded":"2026-07-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://falconfeeds.io/blogs/threat-actors-2026-emerging-groups-every-ciso-should-watch/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/s2wblog/ransomware-landscape-in-h1-2026-statistics-and-key-issues-f15683e233cd","dateAdded":"2026-09-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://medium.com/s2wblog/ransomware-landscape-in-h1-2026-statistics-and-key-issues-f15683e233cd"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure","dateAdded":"2026-10-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure","dateAdded":"2026-10-09T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-53771","url":"https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure"}]}]}