Critical Threat Intelligence & Advisory Summaries
Active exploitation of vulnerability affecting Microsoft Office SharePoint Server products in the UK
Microsoft has published a security advisory detailing a vulnerability affecting on-premises SharePoint Server instances. Microsoft and the NCSC are aware that an exploit for this vulnerability exists in the wild and have observed active attacks.
What has happened?
Microsoft has published a security advisory detailing a vulnerability affecting on-premises SharePoint Server instances.
This vulnerability allows an attacker to remotely execute arbitrary code via the deserialisation of untrusted data. A separate vulnerability, CVE-2025-53771, allows this attack to be performed while bypassing authentication.
Microsoft and the NCSC are aware that an exploit for this vulnerability exists in the wild and have observed active attacks targeting on-premises SharePoint Server customers, including a limited number in the UK.
Who is affected?
Organisations using the following on-premises SharePoint products are affected:
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016
What should I do?
The NCSC recommends following vendor best practice advice to mitigate vulnerabilities. In this case, Microsoft has released security updates that fully protect organisations using SharePoint Subscription Edition, SharePoint 2019 and SharePoint 2016 against the risks posed by CVE-2025-53770 and a related vulnerability, CVE-2025-53771. These updates should be applied immediately to ensure installations are protected.
In addition to applying the specific security update for your version of SharePoint, Microsoft also recommend the following steps be taken to mitigate potential attacks:
1. Use supported versions of on-premises SharePoint Server.
2. Ensure the Anti-malware Scan Interface (AMSI) is turned on and configured correctly, with an appropriate antivirus solution such as Defender Antivirus.
3. Deploy Microsoft Defender for Endpoint protection, or equivalent threat solutions.
4. Rotate SharePoint Server ASP.NET machine keys.
Detailed guidance for each step as well as detection, protection, and hunting, is provided on Microsoft’s website.
If you believe you have been compromised and are in the UK, you should report it to the NCSC.
Further NCSC resources
The NCSC provides a range of free guidance, services and tools that help to secure systems.
- Follow NCSC guidance including vulnerability management and preventing lateral movement.
- If your organisation is in the UK, you can sign up to the free NCSC Early Warning service to receive notifications of potential threats on your network.
- The NCSC Vulnerability Disclosure Toolkit helps organisations of all sizes with the essential components of implementing a vulnerability disclosure process.
PUBLISHED
22 July 2025