Microsoft’s SharePoint servers comes under widespread cyberattack — urgent fix released

Tech giant Microsoft has released an emergency security update following reports of "active attacks" targeting its SharePoint server software used by government bodies and businesses for internal document sharing.

The company confirmed that the vulnerabilities affect only on-premises SharePoint servers. Microsoft 365's cloud-based SharePoint Online remains unaffected.

The attacks reportedly exploit a remote code execution vulnerability linked to the deserialisation of untrusted data.

 “Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update,” the company said in a security advisory. It urged organisations to apply the latest patches without delay.

The United States Federal Bureau of Investigation (FBI) has acknowledged the attacks and is coordinating closely with federal and private-sector partners.

In response, the US Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw — identified as CVE-2025-53770 — to its Known Exploited Vulnerabilities (KEV) catalogue. It has mandated all Federal Civilian Executive Branch (FCEB) agencies to implement the necessary fixes by 21 July 2025.

Microsoft clarified that while some initial documentation contained inconsistencies, the published guidance remains valid and effective.

The company further advised users to rotate SharePoint server ASP.NET machine keys and restart the IIS service after applying the updates. Those unable to enable the Antimalware Scan Interface (AMSI) must rotate their keys post-update installation.

“Microsoft has released security updates that fully protect customers using SharePoint Subscription Edition and SharePoint 2019 against the risks posed by CVE-2025-53770 and CVE-2025-53771. Customers should apply these updates immediately to ensure they’re protected,” the company said.

The situation highlights growing concerns over vulnerabilities in widely used enterprise software and the need for prompt cyber hygiene across public and private sectors.

— With inputs from agencies