Security teams worldwide are on high alert after confirmation of active, real-world exploitation of a serious zero-day vulnerability in Microsoft SharePoint (CVE-2025-53770). Disclosed overnight by Microsoft and amplified in an urgent warning from Google Cloud’s Mandiant unit, the flaw is enabling threat actors to gain unauthenticated, persistent access to vulnerable servers via webshell implants.
The Google Threat Intelligence Group has observed attackers targeting on-premises SharePoint deployments exposed to the internet, exfiltrating cryptographic secrets and establishing footholds within enterprise environments. According to Charles Carmakal, CTO of Mandiant Consulting, this is “not a patch-and-forget situation.”
Speaking via LinkedIn, Carmakal outlined key steps for defenders:
-
Immediate Mitigation: Apply Microsoft’s emergency guidance without delay.
-
Assume Compromise: Investigate servers for prior breaches.
-
Prepare for Patch: Apply Microsoft’s forthcoming emergency update as soon as available.
-
Remediate: If compromise is detected, follow standard incident response procedures.
“This vulnerability represents a significant risk to organizations with publicly accessible SharePoint servers,” Carmakal said. “The attackers aren’t waiting.”
Microsoft has confirmed that SharePoint Online within Microsoft 365 is unaffected, limiting exposure to on-prem deployments.
With threat actors actively exploiting the zero-day, experts warn that organisations should not rely solely on patch release timelines. Instead, an assume-breach mindset is recommended, with continuous monitoring and immediate mitigation efforts considered essential.
The incident serves as another reminder of the critical need for layered defenses and proactive detection capabilities, especially for internet-facing enterprise platforms.
