Microsoft recently warned about a serious zero-day vulnerability in SharePoint Server, registered as CVE-2025-53770. This vulnerability is currently being widely exploited and allows attackers to remotely execute malicious code on affected servers. It is important to emphasize that only on-premises SharePoint installations are vulnerable; SharePoint Online in Microsoft 365 is not susceptible to this attack.

What's going on?

Since July 18, Microsoft has been detecting active attacks that exploit this vulnerability. The attackers manage to bypass existing security measures introduced earlier in July. The method of attack is based on a previously discovered vulnerability that was demonstrated in May during the Pwn2Own event in Berlin. Researchers then showed that it is possible to gain full control of a server with just one request.

Available Emergency Patches

Microsoft has now released emergency patches for SharePoint Server 2019 and the Subscription Edition. For SharePoint Server 2016, an update is still in development but is expected soon. Customers using these versions are strongly advised to install the updates immediately. If this is not possible, Microsoft recommends temporarily disconnecting the affected servers from the Internet to prevent further damage.

Recommended Measures

To mitigate further attacks, Microsoft recommends the following:

• Enable AMSI (Antimalware Scan Interface).: AMSI has been enabled by default since September 2023, but check that it is.
• Install Defender Antivirus on all SharePoint servers.
• Rotate ASP.NET machine keys after applying the updates or activating AMSI. This prevents previously stolen validation keys from being reused.

Detection and Response

The U.S. CISA has added this vulnerability to its catalog of known threats and requires government agencies to take action within 24 hours of the availability of a patch. Several security companies, including Dutch company Eye Security, are now reporting dozens of breaches at both commercial and public organizations worldwide.

Microsoft has published technical documentation with instructions for checking whether a SharePoint server has been compromised. In doing so, note the suspicious file spinstall0.aspx or suspicious HTTP requests in the IIS logs. If found, it is recommended that a forensic investigation be initiated immediately and the affected systems taken offline.

Need help?

Should you or your organization need assistance, we would love to hear from you. Our clients have now been verified.