New Delhi, July 21
Tech giant Microsoft has issued urgent security patch after observing "active attacks" on server software used by government agencies and businesses to share documents within organisations.
According to Microsoft, the vulnerabilities apply only to SharePoint servers used within organisations. SharePoint Online in Microsoft 365, which is in the cloud, was not hit by the attacks, the organisation informed.
“Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update,†said the tech giant in ints security advisory.
The company recommended security updates that customers should apply immediately.
The US Federal Bureau of Investigation (FBI) also said it is aware of the attacks and is working closely with its federal and private-sector partners.
The vulnerability is related to a case of remote code execution that arises due to the deserialization of untrusted data in on-premise versions of Microsoft SharePoint Server.
Microsoft said the current published content is correct and that the previous inconsistency does not impact the company's guidance for customers.
"After applying the latest security updates above or enabling AMSI, it is critical that customers rotate SharePoint server ASP.NET machine keys and restart IIS on all SharePoint servers," Microsoft said.
"If you cannot enable AMSI, you will need to rotate your keys after you install the new security update,†its added.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added ‘CVE-2025-53770’ vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 21, 2025.
“Microsoft has released security updates that fully protect customers using SharePoint Subscription Edition and SharePoint 2019 against the risks posed by CVE-2025-53770, and CVE-2025-53771. Customers should apply these updates immediately to ensure they’re protected,†said the company in its security update.
— IANS
Reader Comments
Our IT team worked overnight to patch this in our company. Scary how quickly these attacks happen! Microsoft should compensate organizations for the extra manpower needed 😤
Good that cloud version wasn't affected. Shows why businesses should migrate to cloud solutions. On-premise servers are becoming too risky to maintain with these frequent vulnerabilities.
As someone working in cybersecurity in Bengaluru, I appreciate Microsoft's quick response but wish they'd caught this during testing. Many Indian SMBs use SharePoint and can't afford breaches.
Does CERT-In have any advisory for Indian companies? We need our own cybersecurity agency to be more proactive rather than just following US alerts.
The timing is suspicious - right before weekend when IT teams are less staffed. Hackers know what they're doing 😰 Our company had to call back people from holiday to handle this.
We welcome thoughtful discussions from our readers. Please keep comments respectful and on-topic.