[ad_1]
On Sunday, July 20, Microsoft Corp. issued an emergency safety replace for a vulnerability in SharePoint Server that’s actively being exploited to compromise weak organizations. The patch comes amid stories that malicious hackers have used the SharePoint flaw to breach U.S. federal and state businesses, universities, and power firms.
Image: Shutterstock, by Ascannio.
In an advisory in regards to the SharePoint safety gap, a.ok.a. CVE-2025-53770, Microsoft mentioned it’s conscious of energetic assaults focusing on on-premises SharePoint Server clients and exploiting vulnerabilities that had been solely partially addressed by the July 8, 2025 safety replace.
The Cybersecurity & Infrastructure Security Agency (CISA) concurred, saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier this month (CVE-2025-49706). Microsoft notes the weak spot applies solely to SharePoint Servers that organizations use in-house, and that SharePoint Online and Microsoft 365 usually are not affected.
The Washington Post reported on Sunday that the U.S. authorities and companions in Canada and Australia are investigating the hack of SharePoint servers, which give a platform for sharing and managing paperwork. The Post stories at the very least two U.S. federal businesses have seen their servers breached by way of the SharePoint vulnerability.
According to CISA, attackers exploiting the newly-discovered flaw are retrofitting compromised servers with a backdoor dubbed “ToolShell” that gives unauthenticated, distant entry to methods. CISA mentioned ToolShell permits attackers to completely entry SharePoint content material — together with file methods and inner configurations — and execute code over the community.
Researchers at Eye Security mentioned they first noticed large-scale exploitation of the SharePoint flaw on July 18, 2025, and shortly discovered dozens of separate servers compromised by the bug and contaminated with ToolShell. In a weblog publish, the researchers mentioned the assaults sought to steal SharePoint server ASP.NET machine keys.
“These keys can be used to facilitate further attacks, even at a later date,” Eye Security warned. “It is critical that affected servers rotate SharePoint server ASP.NET machine keys and restart IIS on all SharePoint servers. Patching alone is not enough. We strongly advise defenders not to wait for a vendor fix before taking action. This threat is already operational and spreading rapidly.”
Microsoft’s advisory says the corporate has issued updates for SharePoint Server Subscription Edition and SharePoint Server 2019, however that it’s nonetheless engaged on updates for supported variations of SharePoint 2019 and SharePoint 2016.
CISA advises weak organizations to allow the anti-malware scan interface (AMSI) in SharePoint, to deploy Microsoft Defender AV on all SharePoint servers, and to disconnect affected merchandise from the public-facing Internet till an official patch is offered.
The safety agency Rapid7 notes that Microsoft has described CVE-2025-53770 as associated to a earlier vulnerability — CVE-2025-49704, patched earlier this month — and that CVE-2025-49704 was a part of an exploit chain demonstrated on the Pwn2Own hacking competitors in May 2025. That exploit chain invoked a second SharePoint weak spot — CVE-2025-49706 — which Microsoft unsuccessfully tried to repair on this month’s Patch Tuesday.
Microsoft additionally has issued a patch for a associated SharePoint vulnerability — CVE-2025-53771; Microsoft says there aren’t any indicators of energetic assaults on CVE-2025-53771, and that the patch is to offer extra sturdy protections than the replace for CVE-2025-49706.
This is a quickly creating story. Any updates might be famous with timestamps.