Microsoft Issues Urgent Patch as Hackers Target SharePoint Server Flaw

By siliconindia  |  Monday, 21 July 2025, 11:31:07 AM IST

Microsoft Issues Urgent Patch as Hackers Target SharePoint Server Flaw
  • Microsoft confirmed ongoing attacks targeting on-premise SharePoint Servers, exploiting a remote code execution vulnerability (CVE-2025-53770).
  • Security updates for SharePoint Subscription Edition and SharePoint 2019 have been released; users must apply them urgently, rotate ASP.NET machine keys, and restart IIS.
  • CISA has added the flaw to its Known Exploited Vulnerabilities list, requiring U.S. federal agencies to patch by July 21, 2025.
In a critical security advisory, tech giant Microsoft has urged all on-premise SharePoint Server users to apply an urgent security update following the discovery of 'active attacks' targeting government agencies and businesses. These vulnerabilities impact SharePoint servers used internally for document sharing and collaboration, while SharePoint Online in Microsoft 365 remains unaffected.
Microsoft revealed that attackers are exploiting a remote code execution vulnerability, identified as CVE-2025-53770, which stems from the deserialization of untrusted data in on-premise SharePoint Server versions. The issue had been partially addressed in the July security update but has seen continued exploitation, prompting a fresh round of patches.
“Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update”, the company noted. The updated security fixes, released for SharePoint Subscription Edition and SharePoint 2019, now offer full protection against the identified threats, including another related vulnerability, CVE-2025-53771.
The company emphasized that after applying the update or enabling AMSI (Antimalware Scan Interface), customers must rotate their ASP.NET machine keys and restart IIS on all SharePoint servers to ensure complete protection. If AMSI cannot be enabled, key rotation is mandatory post-update installation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-53770 to its Known Exploited Vulnerabilities (KEV) catalog and mandated that all Federal Civilian Executive Branch (FCEB) agencies apply the patches by July 21, 2025. The FBI has also confirmed it is monitoring the situation closely in collaboration with federal and private-sector partners.
Microsoft reaffirmed that its updated guidance is accurate and that previous inconsistencies do not affect customer security recommendations.
All affected users are strongly advised to apply the security updates immediately to safeguard critical systems and prevent potential breaches.

ON THE DECK

Top Banner