# Critical Security Alert: Immediate Action Required for Self-Hosted SharePoint Servers (CVE-2025-53770)

> A critical, newly disclosed, and actively exploited vulnerability, CVE-2025-53770, affects all self-hosted / on-premises Microsoft SharePoint Server versions. …

A critical, newly disclosed, and actively exploited vulnerability, [CVE-2025-53770](<https://nvd.nist.gov/vuln/detail/CVE-2025-53770>), affects all self-hosted / on-premises Microsoft SharePoint Server versions. This critical issue does not impact SharePoint Online (Microsoft 365).

The exploit enables attackers to:

  * Bypass authentication
  * Install persistent backdoors
  * Launch ransomware
  * Steal sensitive data



### Immediate Steps to Take:

  * Patch all on-premises SharePoint servers immediately following [Microsoft guidance](<https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/>)
  * Disconnect unpatched servers from the Internet immediately
  * For versions older than SharePoint 2016:
    * Block external access now
    * Plan and execute an upgrade to a supported, patched version urgently
  * Even servers only accessible internally must be patched due to the ease and severity of the exploitation.



 **Note:** If you suspect an attack has occurred and/or been successful, any suspected compromised machine must be isolated immediately, including shutting it down.

It is also recommended to isolate those instances using zero-trust practices to prevent lateral movement of any malware already present in the system.

This vulnerability is being weaponized in the wild and poses a significant risk to data integrity and network security.

 **CVE Reference:** [CVE-2025-53770](<https://nvd.nist.gov/vuln/detail/CVE-2025-53770>)

Be aware that there may be additional vulnerabilities connected to this incident, including CVE-2025-53771, which is related to path traversal in Microsoft Office SharePoint and is currently awaiting analysis as of this publication date.

We highly recommend following and subscribing to the [CISA Cybersecurity Alerts & Advisories](<https://www.cisa.gov/news-events/cybersecurity-advisories>) for the latest updates.

Additional Sources:

  * [https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/](<https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ 
   
https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities
>)
  * [https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities](<https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ 
   
https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities
>)



* * *

## Need Help?

If you need assistance evaluating your systems or applying patches, contact us right away.

Thank you,

Command Prompt Team

---
[View this page online](https://www.commandprompt.com/blog/critical-security-alert-immediate-action-required-for-self-hosted-sharepoint-servers-cve-2025-53770/)