Microsoft Releases Urgent Patch to Counter Server Attacks: What To Know

Newsweek

21-07-2025

Based on facts, either observed and verified firsthand by the reporter, or reported and verified from knowledgeable sources.
Newsweek AI is in beta. Translations may contain inaccuracies—please refer to the original content.
Microsoft has released an emergency security update to address a critical vulnerability in its on-premises SharePoint Server software, following a wave of cyberattacks over the weekend.
The attacks, discovered over the weekend, exploit a previously unknown vulnerability in the document-sharing software, prompting immediate action from both Microsoft and federal investigators.
Newsweek reached out to Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) via email for comment.
Why It Matters
This high-impact breach highlights persistent risks for organizations relying on on-premises SharePoint servers for collaboration and internal document management. Attackers have reportedly bypassed advanced security measures, such as multi-factor authentication (MFA) and single sign-on, gaining privileged access to sensitive U.S. government, educational, health care, and corporate systems.
What To Know
On Sunday, Microsoft released a series of security patches to address the breach, saying that it was "aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update."
In a statement on social media, the tech giant said that "Microsoft has released a security update for SharePoint Subscription Edition to mitigate active attacks targeting on-premises servers. SharePoint Online is not affected. Customers should apply the update immediately. We are actively working on updates for SharePoint 2016 and 2019."
A Microsoft office in New York City as seen on June 24, 2025.
A Microsoft office in New York City as seen on June 24, 2025.
Getty Images
The vulnerability CVE-2025-53770 enables attackers to execute code and bypass traditional defenses remotely. Microsoft's cloud-based SharePoint Online service remains unaffected by these exploits.
Eye Security, a Dutch cybersecurity firm, uncovered the initial compromises after scanning over 8,000 SharePoint servers worldwide, identifying at least 54 organizations, including U.S. federal agencies, banks, and universities, that were breached.
The FBI told Newsweek on Sunday that it is aware of the incidents and is working with federal and private-sector partners to address the threat.
Who People Are Saying
Michael Sikorski, CTO and head of Threat Intelligence for Unit 42 at Palo Alto Networks, told Newsweek: "If you have SharePoint on-prem exposed to the internet, you should assume that you have been compromised at this point. This is a high-severity, high-urgency threat.
"We are urging organizations who are running on-prem SharePoint to take action immediately and apply all relevant patches now and as they become available, rotate all cryptographic material, and engage professional incident response."
The Cybersecurity and Infrastructure Security Agency said on Sunday: "CISA is aware of active exploitation of a new remote code execution (RCE) vulnerability enabling unauthorized access to on-premise SharePoint servers. While the scope and impact continue to be assessed, the new Common Vulnerabilities and Exposures (CVE), CVE-2025-53770, is a variant of the existing vulnerability CVE-2025-49706 and poses a risk to organizations.
"This exploitation activity, publicly reported as "ToolShell," provides unauthenticated access to systems and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network."
What Happens Next
Microsoft is continuing to develop patches for the legacy SharePoint 2016 version, and has advised users to disconnect affected servers from the internet if immediate updates are not available or feasible.