Active Zero-Day Attacks Target On-Premises SharePoint

Microsoft confirms active zero-day attacks are targeting on-premises SharePoint servers, exploiting two new vulnerabilities. Attackers are bypassing security controls to exfiltrate sensitive data and deploy backdoors, urging affected organizations to assume compromise and hunt for invaders.

The phrase “active attacks” rarely portends good news, particularly when it pertains to the digital sinews of governments and major corporations.

Indeed, it carries a stomach-dropping resonance, a visceral alarm bell that cuts through the usual hum of cybersecurity advisories. Active attacks carry a significant threat in today’s digital landscape.

This past weekend, Microsoft issued just such a warning, confirming that its on-premises SharePoint Server customers are currently under siege, caught in the crosshairs of a sophisticated, ongoing campaign.

SharePoint, for the uninitiated, is no mere software; it’s the quiet workhorse of countless organizations, a server-based content and document management system that underpins internal websites, collaborative platforms, and critical documentation.

It’s the digital backbone where sensitive data often resides, making it an irresistible target for those with malicious intent.

The current threat exploits two freshly unearthed, previously unknown vulnerabilities—what the industry chillingly refers to as “zero-day” exploits. Specifically, CVE-2025-53770 and CVE-2025-53771 allow attackers to execute code or perform spoofing over a network, effectively granting them an insidious level of control.

The Cybersecurity and Infrastructure Security Agency (CISA) has shed further light on the nature of these intrusions, describing the exploitation activity as ToolShell.

This moniker alone conjures images of a digital crowbar, prying open systems.

CISA explains that ToolShell provides “unauthenticated access to systems and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network.” This critical information serves as a reminder of the vulnerabilities present.

In layman’s terms, hackers are walking straight through the front door, uninvited and unchallenged, to rummage through the most sensitive digital archives.

While users of SharePoint Online in Microsoft 365 can breathe a sigh of relief—Microsoft assures them their cloud-based systems are unaffected—the same cannot be said for the vast network of on-premises SharePoint servers.

These are the installations used by a staggering number of large organizations and, critically, by governments, including the United States.

The gravity of the situation is underscored by the sheer breadth of agencies now involved: the FBI is actively engaged, working in concert with federal and private-sector partners. Microsoft itself is collaborating closely with CISA, the DoD Cyber Defense Command, and a host of “key cybersecurity partners.”

This formidable gathering of digital defenders offers a sliver of comfort, yet simultaneously amplifies the unsettling truth: the problem is significant enough to warrant such an extensive, high-level response.

Microsoft, commendably, moved swiftly.

An update to patch these vulnerabilities has already been released. Customers running SharePoint Subscription Edition are urged to apply the security update for CVE-2025-53771 immediately.

For those on older versions, specifically SharePoint 2016 or 2019, the directive is clear: upgrade first, then apply the patch.

This rapid deployment of a fix is a testament to the urgency of the threat, yet it also raises a more profound, unsettling question: what damage has already been done?

The chilling answer comes from cybersecurity threat research team Palo Alto Networks Unit 42.

Their assessment, relayed via The Hacker News, paints a grim picture that transcends the simple act of patching.

According to their findings, the attackers have not merely breached perimeters; they have penetrated deep into the digital fabric of compromised entities.

“Attackers are bypassing identity controls, including MFA and SSO, to gain privileged access,” the cybersecurity expert states.

This detail is particularly alarming, as multi-factor authentication (MFA) and single sign-on (SSO) are often touted as foundational pillars of modern digital security, designed to thwart unauthorized access even if passwords are stolen.

Their bypass represents a fundamental erosion of trust in widely adopted security protocols.

The spoils of these breaches are equally disturbing: exfiltration of sensitive data, deployment of persistent backdoors, and the theft of cryptographic keys.

The expert’s warning resonates with a stark, almost apocalyptic finality: “If you have SharePoint on-prem exposed to the internet, you should assume that you have been compromised at this point. Patching alone is insufficient to fully evict the threat.”

This isn’t merely a technical advisory; it’s a strategic decree, urging organizations to move beyond reactive patching to proactive incident response, hunting for invaders already within their networks. Incident response strategies are critical in this evolving landscape.

What elevates this particular threat from serious to catastrophic is SharePoint’s intrinsic interconnectedness within the broader Microsoft ecosystem.

SharePoint isn’t an island; it’s a critical hub deeply integrated with services like Office, Teams, OneDrive, and Outlook.

“A compromise doesn’t stay contained,” the expert warns. “It opens the door to the entire network.”

Imagine a digital spiderweb, where a single compromised strand allows an intruder to traverse the entire structure, reaching into every corner where valuable information resides.

The implications are staggering, suggesting that a breach of SharePoint could cascade into a full-scale network takeover, jeopardizing intellectual property, financial data, and even national security secrets.

As the digital dust begins to settle, the true extent of this compromise remains shrouded in uncertainty.

While Microsoft’s swift action in providing a fix is commendable, the lingering question isn’t whether the vulnerabilities are patched, but how many organizations have already been irrevocably breached, and what sensitive information has already walked out the digital door.

This ongoing saga serves as a stark reminder of the relentless, evolving nature of cyber warfare, where even the most robust defenses can be undermined by previously unknown flaws, and where the battle for digital sovereignty is a perpetual, high-stakes endeavor.

The quiet workhorse of enterprise collaboration has, for now, become a potent symbol of digital vulnerability.