Microsoft SharePoint Vulnerability Exploited in Global Cyber Attack

Microsoft's SharePoint server software has been targeted by a "zero-day" vulnerability attack, posing a significant cybersecurity threat. The company has released a security patch and is collaborating with federal agencies to mitigate risks. This intrusion has raised concerns about the vulnerability of local servers, with potentially tens of thousands of systems worldwide affected.

The U.S. Cybersecurity and Infrastructure Security Agency has urged federal agencies to take immediate mitigating actions. Analysts have advised enterprises to accelerate cloud migration and implement real-time threat detection. The attackers exploited an unknown vulnerability in Microsoft SharePoint Server, and security researchers have confirmed that since the attack began on July 18, dozens of servers globally have been compromised.

In response to the "zero-day" vulnerability attack, Microsoft stated that while the July security update only partially addressed the issue, enterprises could achieve full protection through several additional configuration changes. For the newly identified vulnerabilities, CVE-2025-53770 and CVE-2025-53771, Microsoft recommends enabling the Anti-Malware Scan Interface (AMSI) feature and deploying Microsoft Defender on SharePoint servers for protection.

Microsoft emphasized that the attacks targeted local SharePoint Server customers, exploiting vulnerabilities that were only partially fixed by the July security update. These vulnerabilities affect only local SharePoint Servers, with Microsoft 365's SharePoint Online remaining unaffected.

Industry experts warn that "zero-day" vulnerabilities pose a significant threat to enterprise operations. Attackers can execute code remotely without authentication, potentially giving cybercriminals full control over affected systems. This vulnerability challenges the long-held belief that collaboration infrastructure can be patched according to maintenance cycles.