Schneier on Security: Microsoft SharePoint Zero-Day

Jul 28, 2025

—

Source URL: https://www.schneier.com/blog/archives/2025/07/microsoft-sharepoint-zero-day.html
Source: Schneier on Security
Title: Microsoft SharePoint Zero-Day

Feedly Summary: Chinese hackers are exploiting a high-severity vulnerability in Microsoft SharePoint to steal data worldwide:
The vulnerability, tracked as CVE-2025-53770, carries a severity rating of 9.8 out of a possible 10. It gives unauthenticated remote access to SharePoint Servers exposed to the Internet. Starting Friday, researchers began warning of active exploitation of the vulnerability, which affects SharePoint Servers that infrastructure customers run in-house. Microsoft’s cloud-hosted SharePoint Online and Microsoft 365 are not affected.
Here’s…

AI Summary and Description: Yes

Summary: The text discusses a critical vulnerability in Microsoft SharePoint that is being exploited by Chinese hackers to conduct data theft. The vulnerability, rated 9.8/10 in severity, allows unauthorized remote access to SharePoint servers. This escalating security issue highlights the urgent need for compliance and proactive security measures.

Detailed Description: The text outlines a significant security threat related to a vulnerability in Microsoft SharePoint. Here are the key points to consider:

– **Vulnerability Overview**:
– The vulnerability is tracked as CVE-2025-53770 and has a high severity rating of 9.8 out of 10.
– It provides unauthenticated remote access to SharePoint servers exposed to the Internet, creating a critical risk for organizations.

– **Scope of Impact**:
– The vulnerability specifically affects in-house SharePoint servers and does not impact Microsoft’s cloud-hosted SharePoint Online or Microsoft 365 environments.
– This distinction emphasizes the risk levels between on-premises solutions and cloud alternatives regarding security exposure.

– **Active Exploitation**:
– Reports have emerged of active exploitation starting from Friday, indicating that attackers have begun to use this vulnerability to steal sensitive data, including authentication credentials.

– **Need for Patching**:
– Microsoft has provided patching instructions, but experts warn that simply applying patches may not be sufficient to mitigate risks entirely.
– Attackers may still access systems even after patches are implemented, necessitating additional security measures.

– **CISA Involvement**:
– The Cybersecurity and Infrastructure Security Agency (CISA) has issued guidance and additional information regarding the vulnerability, underscoring its gravity.

– **Broader Implications**:
– This incident highlights the ongoing threat posed by state-sponsored hacking groups and emphasizes the need for organizations to adopt robust security measures, including Zero Trust models and continuous monitoring.

– **Resource Links**:
– The text briefly references additional resources (although not included in detail), suggesting a network of discussions and additional information avenues, such as forums and dedicated security threads.

This vulnerability serves as a reminder for security and compliance professionals to prioritize infrastructure security, vigilance around patch management, and a proactive stance against evolving cyber threats.

1 10 2 2025 3 5 53 7 a access Act active exploitation ads after age Agency AI alt and app Arch art as at ated attack attackers authentication being Bi by C Chinese Chinese hacker Chinese hackers CI CISA Cloud co compliance compliance professionals continuous continuous monitoring credential credentials critical critical risk critical vulnerability Customer CVE cyber cyber threat cyber threats cybersecurit Cybersecurity Cybersecurity and Infrastructure Security Agency Cybersecurity and Infrastructure Security Agency (CISA) D data data theft day de e environment exp expert Experts exploit Exploitation Fly for g Gen Go Group guidance H hack hacker hackers hacking hacking group hacking groups high high severity Highlight hosted HR http HTTPS implications in incident information infrastructure infrastructure security instruction inter intern internet io Iron issue ite k Key l Lance led level Li Link low M man management measures Micro Microsoft Microsoft 365 Microsoft SharePoint ML Mode model models Monitor monitoring N native network NGO no o oE of on on-premises solutions opt organization organizations oS out over Patch Patch Management patches patching per point pre premises premises solutions pro proactive proactive security proactive security measures proactive stance professionals ps R rack rate RCE re red remote Remote Access report research researchers resource resources Risk risks Ro robust security Rust s scope search sec security security and compliance security measure security measures security threat sensitive data server servers severity severity rating SHA SharePoint SharePoint Server SharePoint servers side Sig Sim size sizes solutions source specific sponsored sponsored hacking SSE STAR start state state-sponsored state-sponsored hacking system systems T ted text the theft Threads threat threats to Tor TP trust trust model trust models two UI unauthenticated under up ups US use uth V vigilance vulnerability Wi world x z zero Zero Trust Zero Trust model zero-day