Microsoft Issues Critical Security Update to Address SharePoint Vulnerabilities Exploited in Ongoing Attacks

Microsoft has released security patches for an actively exploited vulnerability in SharePoint that allows remote code execution (RCE) due to deserialization of untrusted data. This flaw, tracked as CVE-2025-53770, affects on-premises versions of SharePoint Server and has been exploited in cyberattacks targeting organizations, including banks, universities, and government entities. The issue was discovered after active exploitation began around July 18, 2025. Microsoft also addressed a spoofing vulnerability (CVE-2025-53771) related to path traversal, which allows attackers to spoof data on SharePoint servers. These vulnerabilities are linked to previous issues (CVE-2025-49704 and CVE-2025-49706), forming an exploit chain known as ToolShell. The July 2025 Patch Tuesday updates offer stronger protections for CVE-2025-53770 and CVE-2025-53771 compared to earlier updates. This vulnerability does not affect SharePoint Online but poses a significant risk to on-premises servers. Microsoft has advised customers to update their systems, enable antivirus protection, rotate cryptographic keys, and apply other security measures to mitigate the risks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included CVE-2025-53770 in its catalog of Known Exploited Vulnerabilities, urging federal agencies to patch the flaw immediately. Security experts warn that organizations with exposed SharePoint servers are likely compromised and must take swift action.