![\"Microsoft](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/07\/1753012569_39_960x0.jpg\")
<\/p>\n<\/p>\n
Microsoft SharePoint is under attack.<\/p>\n
SOPA Images\/LightRocket via Getty Images<\/p>\n
Microsoft users are, once again, under attack. This time, the threat is not restricted to Outlook users<\/a>, or involves a Windows browser-based security bypass<\/a>, and unlike the recent Windows authentication relay attack<\/a> vulnerability, there is no patch, no magic update, to remedy this one. Which is bad news for Microsoft SharePoint Server users, as CVE-2025-53770 is currently under confirmed \u201cmass attack\u201d and on-premises servers across the world are being compromised. Here\u2019s what you need to know and do.<\/p>\n ForbesThis Password Hack Jumps From Laptop To Smartphone \u2014 Attacks UnderwayBy Davey Winder<\/a> It\u2019s been quite the few weeks for security warnings, what with Amazon informing 220 million customers of Prime account attacks<\/a>, and claims of a mass hack of Ring doorbells<\/a> going viral. The first of those can be mitigated by basic security hygiene, and the latter appears to be a false alarm. The same cannot be said for CVE-2025-53770, a newly uncovered and confirmed attack against users of SharePoint Server which is currently undergoing mass exploitation on a global level, according to the Eye Research<\/a> experts who discovered it. Microsoft, meanwhile, has admitted<\/a> that not only is it \u201caware of active attacks\u201d but, worryingly, \u201ca patch is currently not available for this vulnerability.\u201d<\/p>\n CVE-2025-53770, which is also being called ToolShell, is a critical vulnerability in on-premises SharePoint. The end result of which is the ability for attackers to gain access and control of said servers without authentication. If that sounds bad, it\u2019s because it is. Very bad indeed.<\/p>\n \u201cThe risk is not theoretical,\u201d the researchers warned, \u201cattackers can execute code remotely, bypassing identity protections such as MFA or SSO.\u201d Once they have, they can then \u201caccess all SharePoint content, system files, and configurations and move laterally across the Windows Domain.\u201d<\/p>\n And then there\u2019s the theft of cryptographic keys. That can enable an attacker to \u201cimpersonate users or services,\u201d according to the report, \u201ceven after the server is patched.\u201d So, even when a patch is eventually released, and I would expect an emergency update to arrive fairly quickly for this one, the problem isn\u2019t solved. You will, it was explained, \u201cneed to rotate the secrets allowing all future tokens that can be created by the malicious actor to become invalid.\u201d<\/p>\n And, of course, as SharePoint will often connect to other core services, including the likes of Outlook and Teams, oh and not forgetting OneDrive, the threat, if exploited, can and will lead to \u201cdata theft, password harvesting, and lateral movement across the network,\u201d the researchers warned.<\/p>\n
\nMicrosoft Confirms CVE-2025-53770 SharePoint Server Attacks<\/p>\n