sharepoint

Critical SharePoint Zero-Day Under Attack: What You Need to Know

Today in Tech

21 Jul 2025 — 2 min read

Critical SharePoint Zero-Day Under Attack: What You Need to Know

A critical security vulnerability is currently being exploited in Microsoft SharePoint Server, posing a significant risk to organizations using on-premises versions. This zero-day vulnerability, identified as CVE-2025-53770, allows for remote code execution (RCE) and is actively under attack. Here's what you need to know to protect your systems.

Protecting Against Vulnerabilities in SharePoint Add-ons | PPT

Understanding the SharePoint Vulnerability (CVE-2025-53770)

CVE-2025-53770 is a remote code execution vulnerability that affects on-premises Microsoft SharePoint Servers. The vulnerability stems from deserialization of untrusted data, which allows an unauthenticated attacker to execute arbitrary code over the network. This means that attackers can gain unauthorized access to your SharePoint systems and potentially compromise sensitive data.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding the active exploitation of this vulnerability, adding it to their Known Exploited Vulnerabilities catalog. This highlights the severity and urgency of the situation.

Impact and Scope

The impact of CVE-2025-53770 is significant. Successful exploitation can lead to:

Unauthorized access to SharePoint servers
Remote code execution, allowing attackers to run malicious code on the server
Data breaches and compromise of sensitive information
System downtime and disruption of services

Reports indicate that the vulnerability has been actively exploited since at least July 18th, with numerous servers already compromised worldwide. The scope of the attack appears to be large-scale, making it crucial for organizations to take immediate action.

Mitigation Strategies

Currently, there is no patch available for CVE-2025-53770. However, Microsoft and CISA recommend the following mitigation strategies to protect your SharePoint Server environment:

Enable AMSI Integration: Configure Antimalware Scan Interface (AMSI) integration in SharePoint.
Deploy Defender AV: Deploy Microsoft Defender Antivirus (or a compatible AV solution) on all SharePoint servers.
Monitor for Suspicious Activity: Closely monitor your SharePoint servers for any unusual or suspicious activity.
Restrict Access: Limit access to SharePoint servers from the internet where possible. Consider using a VPN or other access control mechanisms.
Apply Least Privilege: Ensure that users and services have only the necessary permissions to perform their tasks.

Datawiza also suggests removing internet exposure or enforcing authentication with a SharePoint proxy to reduce risk.

Key Takeaways

A critical zero-day vulnerability (CVE-2025-53770) is actively being exploited in Microsoft SharePoint Server.
The vulnerability allows for remote code execution and can lead to significant security breaches.
No patch is currently available, making mitigation strategies essential.
Implement the recommended mitigation steps immediately to protect your SharePoint environment.