Microsoft Releases Emergency Patches for SharePoint Software Amid Attacks

Microsoft has taken urgent action to protect users of its SharePoint work management software by releasing emergency security patches in response to zero-day vulnerabilities. These vulnerabilities have been exploited in spoofing attacks that have resulted in the theft of sensitive data and passwords, impacting governments, businesses, and universities globally.

In a blog post published on Sunday, Microsoft acknowledged the active attacks targeting on-premises SharePoint Server customers and the exploitation of vulnerabilities not fully addressed by the July Security Update. The company has focused its efforts on providing cumulative patches for the "SharePoint Server Subscription Edition," "SharePoint Server 2019," and "SharePoint Server 2016," emphasizing that the cloud-based SharePoint 365 version remains unaffected.

The vulnerabilities, known as CVE-2025-53770 and CVE-2025-53771, were first disclosed by Eye Security, a cybersecurity firm based in the Netherlands. Eye Security described the vulnerabilities as enabling a "large-scale exploitation of a new SharePoint remote code execution," with multiple waves of attacks identified by the company over the weekend.

The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the ToolShell chain utilized in these attacks, highlighting its ability to grant malicious actors access to SharePoint content, execute code remotely, and compromise internal configurations. With over 200,000 organizations and 190 million users relying on SharePoint for content management and collaboration, the urgency of these security patches is crucial to safeguarding sensitive information.