Urgent Threat Brief: Understanding the Active Exploitation of Microsoft SharePoint Vulnerabilities

Unit 42 has identified serious threats against on-premises Microsoft SharePoint servers, particularly affecting sectors like government, education, and healthcare. While SharePoint Online currently seems safe, many organizations using older versions need to act quickly.

Recently reported vulnerabilities, including CVE-2025-49704 and CVE-2025-49706, allow attackers to execute unrestricted commands on compromised systems. These weaknesses are particularly alarming because of SharePoint’s integration with Microsoft services like Office and Teams, posing risks to the entire network.

According to Microsoft, these vulnerabilities apply to SharePoint Enterprise Server 2016 and 2019, as well as the Subscription Edition. Exploits have already been observed, with attackers bypassing multi-factor authentication and gaining access to sensitive data.

This situation is evolving, prompting strong recommendations for organizations using vulnerable SharePoint versions:

• Apply all security patches immediately.
• Rotate cryptographic materials.
• Engage with cybersecurity professionals for a thorough assessment.

Palo Alto Networks urges continuous monitoring of updates from Microsoft, as the vulnerabilities are under active exploitation. They encourage organizations to assume compromise if they have public-facing SharePoint servers and to take swift action to secure their environments.

Experts note the urgency: Miguel Aguirre, a cybersecurity analyst, stated, “With the frequency of these vulnerabilities being discovered, organizations must prioritize patch management and regular security assessments.” Recent surveys reveal that up to 55% of companies are at risk due to outdated software.

To support organizations, tools like Cortex XDR can block known exploits related to these vulnerabilities and help identify exposed devices in public networks.

In summary, if you manage servers with SharePoint, it’s critical to take these threats seriously. Regular updates, a strong security posture, and quick response to potential breaches are vital to safeguarding your operations.

Source link