Imperva Cyber Community

Hi Imperva,

Could you please advise if there are plans to release an update for this signature(CVE-2025-53770) in the Emergency Feed for WAF On-Premise?

#CloudWAF(formerlyIncapsula)
#On-PremisesWAF(formerlySecuresphere)

------------------------------
Kovit Thakral
SE
Exclusive Networks (Thailand)
------------------------------

Hi Kovit,

Thanks for the post. 

I checked in with our Threat Research team and they advised:

Our On-Prem WAF customers are already protected by an existing signature called CVE-2023-33160-Microsoft SharePoint Server Remote Code Execution Vulnerability, so there is no need.

I hope this helps. You may also find this newly published blog interesting:
Imperva Customers Protected Against Critical "ToolShell" Zero‑Day in Microsoft SharePoint | Imperva

Hi Kovit,

As @Sarah Lamont said, I concurred. 

This signature is included in the "Recommended Signatures Policy for Web Applications" -related to CVE-2025-53770.

If the Recommended Signatures Policy is enabled and in "blocking mode", no need to do anything.

Leangf