Researchers believe the issue is likely to lead to a large number of victims including governments and enterprises, and warn that attackers are compromising cryptographic keys allowing them to maintain access to victims’ systems even after the affected servers are patched. Microsoft issued an urgent alert over the weekend after threat actors were discovered exploiting a zero-day vulnerability in on-premise SharePoint servers on a global basis. The company scanned the internet and discovered dozens of systems that had been compromised in two waves of attacks on Friday evening and Saturday morning. The compromise of SharePoint’s internal cryptographic keys is particularly worrying, researchers say, and means that entities that have been compromised will need to take extra steps to recycle some of the most fundamental settings used to keep themselves secure. In emergency guidance published Saturday night, Microsoft said it was working on a patch for the remote code execution vulnerability, which is being formally tracked as CVE-2025-53770. A security update for SharePoint (other than the 2016 edition) was eventually released in the early hours of Monday morning, covering both CVE-2025-53770 and a less critical vulnerability registered as CVE-2025-53771. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities catalog on Sunday with a “due date” of Monday, meaning all federal agencies are legally required to immediately fix the issue. Eye Security, a European cybersecurity company, said it was the first to identify the widespread exploitation of the vulnerability in the world in a blog post on Friday evening. The agency issued a similarly immediate call for federal agencies to patch the Citrix Bleed 2 bug earlier this month, at the time a record for how quickly a bug needed to be patched. Affected customers were urged to immediately reconfigure their systems or disconnect SharePoint until a patch is available. According to its blog, the company has attempted to directly inform the affected organizations and the relevant national CERTs with detailed evidence about the compromises.
This Cyber News was published on therecord.media. Publication date: Mon, 21 Jul 2025 11:05:16 +0000