A critical zero-day vulnerability in Microsoft's SharePoint server software has exposed an estimated 10,000 organizations to significant risk. The flaw, affecting on-premises versions, has been exploited by sophisticated threat actors, including Chinese government-linked groups. It allows unauthorized access to servers and enables attackers to steal cryptographic keys for impersonating legitimate users or services. The vulnerability persists even after patching or rebooting. Microsoft released an emergency patch, but experts warn that organizations should assume compromise if they were running vulnerable versions before applying it. High-profile targets, including the US National Nuclear Security Administration, have been affected. This incident underscores the evolving sophistication of cyber threats and the critical importance of timely security updates.
In a concerning development for cybersecurity professionals worldwide, a critical zero-day vulnerability in Microsoft’s SharePoint server software has placed an estimated 10,000 organizations at significant risk. The security flaw, which affects on-premises versions of SharePoint, has already been exploited by sophisticated threat actors, including groups linked to the Chinese government. This serious breach has impacted government agencies, energy companies, universities, and even the US National Nuclear Security Administration, highlighting the far-reaching implications of this security incident.
The vulnerability, officially designated as CVE-2025-53770, was first identified by security researchers on July 18, 2025. What makes this security flaw particularly dangerous is its ability to allow unauthorized access to SharePoint servers and enable attackers to steal cryptographic keys that can be used to impersonate legitimate users or services. Most alarmingly, this access persists even after the affected server has been patched or rebooted, creating a persistent backdoor into compromised systems.
Microsoft has confirmed that the vulnerability has been actively exploited since at least July 7, 2025, giving attackers a significant head start before detection. The software giant released an emergency patch on Sunday, July 20, to address the issue, but security experts warn that organizations should assume their systems have already been compromised if they were running vulnerable versions of SharePoint before applying the patch.
Technical analysis of the vulnerability reveals its severity. The exploit chain combines two distinct security flaws – a SharePoint Server spoofing vulnerability (CVE-2025-53771) and a remote code execution vulnerability (CVE-2025-53770). Together, these vulnerabilities create a powerful attack vector that allows threat actors to bypass identity protections like single sign-on and multi-factor authentication, access sensitive content on SharePoint servers including configurations and system files, and gain lateral access across Windows domains.
Trey Ford, Chief Information Security Officer at Bugcrowd, explained the gravity of the situation: “CVE-2025-53770 gives a threat actor the ability to remotely execute code, bypassing identity protections, giving access to content on the SharePoint server including configurations and system files, opening up lateral access across the Windows domain.” This comprehensive access makes it an ideal target for ransomware operators and nation-state actors alike.
Microsoft has attributed the attacks to three Chinese nation-state actors: Linen Typhoon, Violet Typhoon, and Storm-2603. Each group has distinct objectives and capabilities. Linen Typhoon, active since 2012, specializes in stealing intellectual property and primarily targets government, defense, and human rights organizations. Violet Typhoon, operating since 2015, focuses on espionage against a range of targets including former government personnel, educational institutions, and financial businesses. The newer Storm-2603 group has been linked to ransomware attacks using the Warlock ransomware strain, demonstrating the diverse threats posed by these actors.
The breach has affected high-profile targets, most notably the US National Nuclear Security Administration (NNSA), which is responsible for designing and maintaining America’s nuclear weapons. While reports indicate that no sensitive or classified information was compromised in the NNSA breach, the mere fact that attackers could penetrate such a critical government agency underscores the severity of this vulnerability. The Department of Energy stated that it was “minimally impacted due to its widespread use of the Microsoft M365 cloud and very capable cybersecurity systems,” with only “a very small number of systems” affected.
What makes this vulnerability particularly concerning is its potential for long-term damage. Security experts warn that the Chinese threat actor groups allegedly behind this attack are known for using stolen credentials to establish persistent backdoors. This means that even after the initial vulnerability is patched, these attackers can remain hidden inside a network, ready to launch future espionage campaigns.
For organizations running on-premises SharePoint servers, Microsoft has released comprehensive guidance on mitigating the threat. This includes applying the latest security patches for affected versions (SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016), ensuring that Windows Antimalware Scan Interface (AMSI) is properly configured with an antivirus product like Microsoft Defender, and rotating SharePoint Server ASP.NET machine keys.
Additionally, security experts recommend minimizing attack surface by reducing the number of internet-exposed services and implementing network segmentation to contain potential breaches. The US Cybersecurity and Infrastructure Security Agency (CISA) has advised that any servers affected by the exploit should be disconnected from the internet until a full patch is applied and systems are thoroughly scanned for signs of compromise.
This incident serves as a stark reminder of the evolving sophistication of cyber threats and the critical importance of timely security updates. Organizations running on-premises SharePoint installations should act immediately to apply the necessary patches and investigate potential indicators of compromise. It also highlights the advantages of cloud-based solutions like SharePoint Online, which were not affected by this vulnerability.
As cyber threats continue to evolve in complexity and impact, this SharePoint vulnerability demonstrates how quickly security flaws can be weaponized by sophisticated actors. The race between attackers exploiting vulnerabilities and organizations deploying patches remains an ongoing challenge in cybersecurity. For the thousands of organizations affected by this incident, the lessons learned will hopefully lead to stronger security postures and more resilient systems in the future.
