Archive · 23 Jul 2025
Microsoft SharePoint Vulnerability Exploited in Global Cyber Attacks
A security flaw in Microsoft's SharePoint software is being used by hackers to break into computers.
This flaw lets them access important files and systems.
It's like having a key to the building.
Hackers have been using this to steal information from big companies and even some government agencies, including the NNSA.
Microsoft is trying to fix the problem with updates, but hackers keep finding new ways to exploit the vulnerability.
Experts are telling people to update their software right away and take extra steps to protect their systems.
A zero-day vulnerability in Microsoft SharePoint is being exploited in widespread attacks.
Hackers are targeting on-premise SharePoint servers, affecting businesses and government agencies.
The U.S. National Nuclear Security Administration (NNSA) was among the affected organizations.
Microsoft has released patches, but earlier ones were bypassed; additional updates are needed.
Cybersecurity agencies recommend immediate patching and further mitigations.
- Who
- Hackers are exploiting the vulnerability to target businesses, government agencies, and other organizations.
- What
- A zero-day vulnerability in Microsoft SharePoint software is being actively exploited by hackers.
- When
- The attacks likely began on July 18, with initial reports emerging earlier in the month.
- Where
- The attacks have affected on-premise SharePoint servers worldwide, including the U.S. and other countries.
- Why
- Hackers are exploiting the vulnerability to gain access to sensitive data and potentially deploy malicious software.
Vulnerable Organizations
Microsoft Cloud Service Users
Impact
Vulnerable Organizations
Organizations with on-premise SharePoint servers, particularly within government, healthcare, and large enterprise companies, are at immediate risk.
Microsoft Cloud Service Users
Microsoft's cloud-based SharePoint Online service is unaffected.
- Vulnerability Type
- Zero-day exploit
- Affected Software
- Microsoft SharePoint Server
- Impacted Organizations
- Businesses, government agencies, including the U.S. NNSA
- Initial Patch Release
- Earlier this month
- Current Status
- Active exploitation, requiring immediate patching and mitigation
- Estimated Servers Vulnerable
- Over 8,000 worldwide
