Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-patches-for-sharepoint-rce-flaws-exploited-in-attacks/

Microsoft has released emergency SharePoint security updates for two zero-day vulnerabilities tracked as CVE-2025-53770 and CVE-2025-53771 that have compromised services worldwide in "ToolShell" attacks.

In May, during the Berlin Pwn2Own hacking contest, researchers exploited a zero-day vulnerability chain called "ToolShell," which enabled them to achieve remote code execution in Microsoft SharePoint.

These flaws were fixed as part of the July Patch Tuesday updates; However, threat actors were able to discover two zero-day vulnerabilities that bypassed Microsoft's patches for the previous flaws.

Using these flaws, the threat actors have been conducting ToolShell attacks on SharePoint servers worldwide, impacting over 54 organizations so far.

Microsoft has now rushed out emergency out-of-band security updates for Microsoft SharePoint Subscription Edition and SharePoint 2019 that fix both the CVE-2025-53770 and CVE-2025-53771 flaws.

Microsoft is still working on the SharePoints 2016 patches and they are not yet available.

Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks

Microsoft has released emergency SharePoint security updates for two zero-day vulnerabilities tracked as CVE-2025-53770 and CVE-2025-53771 that have compromised services worldwide in "ToolShell" attacks.

www.bleepingcomputer.com

 

[Brownie2019]

Microsoft issued an urgent warning on Saturday to SharePoint Server customers, saying active attacks are targeting a zero-day vulnerability in the software product, which has been assigned CVE-2025-53770 with a CVSS score of 9.8.
A patch is currently not available for the flaw, dubbed “ToolShell“, which Microsoft says is a variant of CVE-2025-49706.

The Redmond, Washington-based tech giant said a security update is currently in the works and provided mitigation instructions and detection guidance. Security teams should take immediate action to implement mitigations in the meantime.
“Google Threat Intelligence Group has observed threat actors exploiting this vulnerability to install webshells and exfiltrate cryptographic secrets from victim servers,” a Google Spokesperson told SecurityWeek. “This allows for persistent, unauthenticated access and presents a significant risk to affected organizations.”

Researchers at Eye Security say they discovered “dozens of systems actively compromised,” which they say likely occurred in attacks around of July 18th around 18:00 CET and July 19th around 07:30 CET.
The Palo Alto Networks Unit42 team said on Saturday that it also has seen active exploitation of vulnerabilities for CVE-2025-49704 and CVE-2025-49706 that affect Microsoft SharePoint.
“To protect your on-premises SharePoint Server environment, we recommend customers configure AMSI integration in SharePoint and deploy Defender AV on all SharePoint servers. This will stop unauthenticated attackers from exploiting this vulnerability,” Microsoft explained it its advisory.

“Organizations need to implement mitigations right away (and the patch when available), assume compromise, investigate whether the system was compromised prior to the patch/mitigation, and take remediation actions,” commented Charles Carmakal, CTO, Mandiant Consulting – Google Cloud.
Microsoft said it would provide updates and additional guidance as they become available.

CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on Sunday, July 20th.
SecurityWeek will update this article and provide additional coverage as details evolved.
UPDATE, July 21: Microsoft has assigned a second CVE identifier, CVE-2025-53771, and it has started releasing patches for the ToolShell zero-days.
UPDATE, July 22: The first attack waves, which targeted high-value organizations, have been linked to China.

SharePoint Under Attack: Microsoft Warns of Zero-Day Exploited in the Wild – No Patch Available

Microsoft warned SharePoint Server users of a vulnerability dubbed ToolShell in the software that was assigned CVE-2025-53770 (CVSS 9.8).

www.securityweek.com

 

[Brownie2019]

National Nuclear Security Administration and National Institutes of Health targeted in global Microsoft SharePoint vulnerability exploitation. Chinese hacking groups suspected in widespread data breaches.
A recent global cyberattack campaign, exploiting critical vulnerabilities in Microsoft’s on-premise SharePoint software, has impacted several US government agencies, including the National Institutes of Health (NIH) and the National Nuclear Security Administration (NNSA).

The breaches, which began around Friday, July 18, have prompted immediate action from affected organizations and a strong response from Microsoft, which attributes the attacks to groups linked to the Chinese government.
The NNSA, a division of the Department of Energy responsible for the nation’s nuclear weapons stockpile, confirmed it was affected, but stated that only a “very small number of systems” were impacted. Notably, no classified information was compromised due to NNSA’s widespread use of Microsoft M365 cloud services and strong cybersecurity systems, as reported by Bloomberg News.

Continue reading:

National Nuclear Security Administration Systems Breached in SharePoint Cyberattack

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

hackread.com

 

[Brownie2019]

Chinese laws requiring vulnerability disclosure to the government create transparency issues and potential conflicts for international cybersecurity efforts.

Microsoft is probing whether a leak from its confidential early warning system enabled Chinese state-sponsored hackers to exploit significant flaws in its SharePoint software, leading to breaches at over 400 organizations, including the U.S. agency responsible for nuclear weapons.

Full Story on:

Microsoft Investigates Leak in Early Warning System Used by Chinese Hackers to Exploit SharePoint Vulnerabilities

Chinese laws requiring vulnerability disclosure to the government create transparency issues and potential conflicts for international cybersecurity efforts.

gbhackers.com

 

[Victor M]

Sharepiont should be an Internal server not exposed to the net. Why is this even happening? If you want to publish info then use the tried and true solutions like web server with WAF and plain html without any bells and whistles.