Microsoft fixes 2 SharePoint zero-days under attack
Digest more
More details emerged on the ToolShell zero-day attacks targeting SharePoint servers, but confusion remains over the vulnerabilities.
Microsoft has observed three China-based threat actors, Linen Typhoon, Violet Typhoon and Storm-2603, exploiting the SharePoint vulnerabilities
While all patches against ‘ToolShell’ exploits are now available for on-premises SharePoint Servers, attackers will be looking to utilize the vulnerabilities for months to come, security researchers tell CRN.
Unknown threat actors are using a weaponised version of an exploit showcased at Pwn2Own Berlin in May to target SharePoint servers around the world.
SharePoint vulnerabilities are under active attack. Microsoft released emergency patches, but some SharePoint versions remain unpatched.
At least 85 servers worldwide have been compromised through a Microsoft service vulnerability that has been used to achieve remote code execution.
The zero-day flaw, tracked as CVE-2025-53770 (CVSS score: 9.8), has been described as a variant of CVE-2025-49706 (CVSS score: 6.3), a spoofing bug in Microsoft SharePoint Server that was addressed by the tech giant as part of its July 2025 Patch Tuesday updates.