New “ToolShell” Exploit Targets SharePoint Servers for Full Takeover

FortiGuard Labs has identified a critical new exploit chain dubbed “ToolShell” that is actively being used by multiple threat actors to target on-premises Microsoft SharePoint servers.

This sophisticated attack combines two previously patched vulnerabilities with two fresh zero-day variants to achieve complete remote code execution and system takeover.

The Cybersecurity and Infrastructure Security Agency (CISA) has already added these CVEs to its catalog of Known Exploited Vulnerabilities due to the escalating threat level and active exploitation in the wild.

The ToolShell campaign represents a significant escalation in SharePoint-targeted attacks, leveraging a combination of four distinct vulnerabilities to bypass security measures and establish persistent access to enterprise servers.