Fox News Channel offers its audiences in-depth news reporting, along with opinion and analysis encompassing the principles of free people, free markets and diversity of thought, as an alternative to the left-of-center offerings of the news marketplace.
Hackers are actively exploiting a new zero-day bug in Microsoft's SharePoint Server software. The same software is used by key U.S. government agencies, including those tied to national security. The vulnerability affects on-premise versions of SharePoint, allowing attackers to break into systems, steal data and quietly move through connected services.
While the cloud version is unaffected, the on-premise version is widely used by major U.S. agencies, universities and private companies. That puts far more than just internal systems at risk. Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER NATIONAL SECURITY EXPERTS RAISE CONCERNS AFTER MICROSOFT PROGRAM EXPOSED AS POSSIBLE AVENUE FOR CHINESE SPYING SharePoint zero-day: What you need to know about the exploit The exploit was first identified by cybersecurity firm Eye Security July 18. Researchers say it stems from a previously unknown vulnerability chain that can give attackers full control of vulnerable SharePoint servers without needing any credentials. The flaw lets them steal machine keys used to sign authentication tokens, meaning attackers can impersonate legitimate users or services even after a system is patched or rebooted. According to Eye Security, the vulnerability appears to be based on two bugs demonstrated at the Pwn2Own security conference earlier this year. While those exploits were initially shared as proof-of-concept research, attackers have now weaponized the technique to target real-world organizations. The exploit chain has been dubbed 'ToolShell.' WHAT IS ARTIFICIAL INTELLIGENCE ? How the SharePoint vulnerability lets hackers access Microsoft services Once inside a compromised SharePoint server, hackers can access connected Microsoft services. These include Outlook, Teams and OneDrive. This puts a wide range of corporate data at risk. The attack also allows hackers to maintain long-term access. They can do this by stealing cryptographic material that signs authentication tokens. The U.S. Cybersecurity and Infrastructure Security Agency is urging organizations to act. It recommends checking systems for signs of compromise and isolating vulnerable servers from the internet. Early reports confirmed about 100 victims. Now, researchers believe attackers have compromised more than 400 SharePoint servers worldwide. However, this number refers to servers, not necessarily organizations. According to reports, the number of affected groups is growing rapidly. One of the highest-profile targets is the National Nuclear Security Administration . Microsoft confirmed it was targeted but has not confirmed a successful breach. Other affected agencies include the Department of Education, Florida's Department of Revenue and the Rhode Island General Assembly. Microsoft confirms SharePoint exploit and releases patches Microsoft confirmed the issue, disclosing that it was aware of 'active attacks' exploiting the vulnerability. The company has released patches for SharePoint Server 2016, SharePoint Server 2019 and SharePoint Subscription Edition. Patches for all supported on-prem versions were issued as of July 21. GET FOX BUSINESS ON THE GO BY CLICKING HERE What you should do about the SharePoint security risk If you're part of a business or organization that runs its own SharePoint servers, especially older on-premise versions, your IT or security team should take this seriously. Even if a system is patched, it could still be at risk if machine keys were stolen. Administrators should also rotate cryptographic keys and audit authentication tokens. For the general public, there's no action needed right now since this issue doesn't affect cloud-based Microsoft accounts like Outlook.com, OneDrive or Microsoft 365. But it's a good reminder to stay cautious online. What you should do about the SharePoint security risk If your organization uses on-premise SharePoint servers, take the following steps right away to reduce risk and limit potential damage: 1. Disconnect vulnerable servers: Take unpatched SharePoint servers offline immediately to prevent active exploitation. 2. Install available updates: Apply Microsoft's emergency patches for SharePoint Server 2016, 2019 and Subscription Edition without delay. 3. Rotate authentication keys: Replace all machine keys used to sign authentication tokens. These may have been stolen and can allow ongoing access even after patching. 4. Scan for compromise: Check systems for signs of unauthorized access. Look for abnormal login behavior, token misuse or lateral movement within the network. 5. Enable security logging: Turn on detailed logging and monitoring tools to help detect suspicious activity going forward. 6. Review connected services: Audit access to Outlook, Teams and OneDrive for signs of suspicious behavior linked to the SharePoint breach. 7. Subscribe to threat alerts: Sign up for advisories from CISA and Microsoft to stay updated on patches and future exploits. 8. Consider migration to the cloud: If possible, transition to SharePoint Online, which offers built-in security protection and automatic patching. 9. Strengthen passwords and use two-factor authentication: Encourage employees to stay vigilant. Even though this exploit targets organizations, it's a good reminder to enable two-factor authentication and use strong passwords. Create strong passwords for all your accounts and devices, and avoid using the same password for multiple online accounts. Consider using a password manager, which securely stores and generates complex passwords, reducing the risk of password reuse. Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords CLICK HERE TO GET THE FOX NEWS APP Kurt’s key takeaway This SharePoint zero-day shows how fast research can turn into real attacks. What started as a proof-of-concept is now hitting hundreds of real systems, including major government agencies. The scariest part isn't just the access it gives but how it lets hackers stay hidden even after you patch. Should there be stricter rules around using secure software in government? Let us know by writing to us at Cyberguy.com/Contact Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER Copyright 2025 CyberGuy.com. All rights reserved.
United States Latest News, United States Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Microsoft Confirms Ongoing Mass SharePoint Attack — No Patch AvailableMicrosoft has confirmed that SharePoint Server is under mass attack and no patch is yet available — here’s what you need to know and how to mitigate the threat.
Read more »
Microsoft Issues Alert After Critical SharePoint Server AttacksMicrosoft warned of active zero-day attacks on SharePoint servers used by government and businesses, with FBI investigating.
Read more »
Microsoft alerts businesses and governments to attacks on SharePoint serversMicrosoft has issued an alert about “active attacks” on server software used by government agencies and businesses to share documents within organizations and recommended security updates that customers should apply immediately.
Read more »
Microsoft SharePoint servers are under attack because of a major security flawHackers have exploited vulnerabilities in Microsoft’s SharePoint software, exposing thousands of on-premises servers used by global businesses and agencies.
Read more »
Microsoft SharePoint under 'active exploitation,' Homeland Security's CISA saysMicrosoft said the company has been 'coordinating closely with CISA, DOD Cyber Defense Command, and key cybersecurity partners around the world throughout our response.'
Read more »
Microsoft Sharepoint server vulnerability puts an estimated 10,000 organizations at riskSteve should have known that civil engineering was not for him when he spent most of his time at university monkeying with his 8086 clone PC. Although he graduated, a lifelong obsession of wanting the Solitaire win animation to go faster had begun.
Read more »