Microsoft Issues Urgent Patches for Active SharePoint Vulnerabilities

Microsoft has released emergency security updates to address two zero-day vulnerabilities in SharePoint, tracked as CVE-2025-53770 and CVE-2025-53771, which have been exploited in ‘ToolShell’ attacks. These vulnerabilities allow hackers to execute remote code on affected servers, stealing sensitive digital keys and planting malware on the servers without the need for credentials. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that these vulnerabilities are actively being exploited to compromise SharePoint installations globally. Researchers discovered that more than 10,000 companies with SharePoint servers are at risk, with the highest concentrations in the U.S., UK, Netherlands, and Canada. While Microsoft has released patches for SharePoint 2019 and Subscription Edition, fixes for SharePoint 2016 are still in development. Microsoft has advised administrators to immediately apply the updates and rotate machine keys to prevent re-exploitation. This situation highlights the critical need for timely patching to safeguard against severe vulnerabilities that can lead to significant breaches of sensitive data.