The recent wave of attacks on Microsoft SharePoint has revealed an alarming number of organizations compromised due to zero-day vulnerabilities. Since the 18th of July, security providers have observed intensified attack patterns targeting reachable SharePoint servers online. The primary exploit leverages previously patched vulnerabilities (CVE-2025-49704 and CVE-2025-49706) but also utilizes unpatched zero-day flaws (CVE-2025-53770 and CVE-2025-53771). Initially, the scope was unclear with over 80 known victims. However, as of now, more than 400 organizations across various sectors have been compromised, many in the US and Germany. The attackers use these vulnerabilities to deploy ransomware and other malicious payloads. Microsoft has released emergency updates to address these issues but warns that numerous threat actors are still exploiting these weaknesses, including small cybercriminals and state-sponsored groups. Administrators must act swiftly by applying patches, monitoring systems for signs of compromise, and implementing additional security measures to prevent further damage.
Third-party sources confirm the extent of the issue with reports from ESET Research detailing specific IP addresses used in attacks between July 17th and 22nd. The company also notes that while Chinese APTs are active participants, a wide array of threat actors exploit these vulnerabilities. Microsoft’s security blog highlights ongoing efforts to disrupt exploitation activities and warns of ransomware deployments via compromised systems. Detailed analyses from independent researchers provide insights into IoCs (Indicators of Compromise) and recommended countermeasures for SharePoint administrators.
Analysis of Zero-Day Attacks on Microsoft Products
Similar questions
What are zero-day vulnerabilities?
How many organizations have been affected so far?
Which countries have the most compromised organizations?
What kind of attacks are being used against SharePoint servers?
Are there any specific CVE numbers mentioned for the vulnerabilities exploited?
Who released emergency updates to address these issues?
Why is it important for administrators to apply patches quickly?
How can I check if my organization’s systems are compromised?
What additional security measures should be implemented besides applying patches?
Which types of attackers are exploiting these weaknesses according to Microsoft?