In a major cybersecurity incident, Microsoft SharePoint servers have become the target of active zero-day exploits, compromising over 75 servers across government agencies, universities, telecoms, and corporations globally. Researchers and security analysts are sounding alarms over the severity and scale of this exploit campaign, which continues to evolve as unpatched systems remain vulnerable.
What Happened?
Two critical vulnerabilities — now tracked as CVE-2025-53770 and CVE-2025-53771 — have been exploited in on-premises Microsoft SharePoint environments. The attack vector enables remote code execution (RCE) without user interaction, making it extremely dangerous for unprotected infrastructures.
Security researchers confirmed that at least 29 organizations, including U.S. state agencies, have been affected. This marks one of the largest SharePoint-based cyberattacks to date.
“This is a full-blown zero-day exploit targeting Microsoft server software. The threat actors are breaching internal networks and establishing persistence.”
— Cybersecurity analyst at The Hacker News
Who Is Affected?
- On-premise Microsoft SharePoint 2016 & 2019
- Enterprises using outdated SharePoint configurations
- Agencies with weak endpoint detection systems
Is There a Fix?
Microsoft has issued an emergency patch for SharePoint Subscription Edition via KB5002768, but older versions such as SharePoint 2016 and 2019 remain without official fixes at this time.
Recommended Actions:
- Enable AMSI (Antimalware Scan Interface) for better malware inspection
- Use Microsoft Defender Antivirus with cloud protection
- Restrict internet access to vulnerable SharePoint servers
- Monitor logs for any suspicious SharePoint-related activity
Wider Implications
This incident comes amid a wave of zero-day attacks, including a Google Chrome vulnerability (CVE-2025-6558) and SonicWall SMA appliance zero-day backdoors. It signals an ongoing trend of state-backed or financially motivated threat actors exploiting unpatched enterprise software.
In parallel, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Microsoft have issued joint alerts, warning that these attacks may continue to escalate.
Why This Matters
This zero-day campaign highlights the critical need for timely patch management, layered defense strategies, and proactive threat monitoring. Organizations must treat software updates as essential security operations, not optional maintenance.
The window between vulnerability disclosure and exploitation is shrinking. In today’s cyber climate, every unpatched hour invites potential compromise.
Related Incidents
- Google Chrome Patch Issued for Active Exploitation Zero-Day
- Explore More Cybersecurity Predictions for the Future
Final Thoughts
If your organization uses Microsoft SharePoint, immediate action is critical. Apply available patches, isolate outdated servers, and enhance endpoint protection.
This is a wake-up call: Zero-days are no longer rare— they are the new normal.
Stay updated on more cybersecurity alerts in our Tech News section and follow our blog UpdateSaga for the latest in tech and AI.
