Critical SharePoint Vulnerabilities in 2025: Patch Fast or Migrate Now

• 25 July 2025
• Security,SharePoint
• Written by George Dockrell

The clock is ticking for organizations running SharePoint on-premises. Since 19 July 2025, a few newly discovered vulnerabilities have been actively exploited, exposing serious weaknesses in legacy SharePoint environments. These are not theoretical risks or isolated incidents. They are real attacks unfolding across industries and demand immediate attention in real-time.

The first wave of exploits, known as ToolShell (CVE‑2025‑49704 and CVE‑2025‑49706), surfaced in early July. These flaws allow unauthenticated attackers to bypass SharePoint’s security controls and execute code remotely. Microsoft released patches in response. However, the situation escalated rapidly. Within days, attackers introduced a bypass variant, CVE‑2025‑53770, which is even more severe. Rated 9.8 out of 10 in criticality, this exploit abuses unsafe data deserialization to enable remote code execution without any authentication, giving attackers full control of targeted systems.

Despite Microsoft’s emergency patches, attackers continue to exploit systems that remain unpatched or only partially secured. On-premises SharePoint environments now face a fast-moving threat landscape that traditional defense cycles struggle to keep up with.

If your organization is still running SharePoint locally, your environment could already be vulnerable. Patching is no longer just a recommendation; it is the bare minimum. With attackers moving faster than ever, migrating to a secure cloud-based environment is no longer a future consideration. It is a necessary next step.

Immediate support for recent SharePoint threats and vulnerabilities. Get in touch!

Unpatched SharePoint? What You’re Risking

The vulnerabilities allow attackers to extract SharePoint’s MachineKey, a cryptographic component used to validate authentication tokens. With this key, attackers can forge tokens, impersonate users, and maintain long-term access. Even after applying security patches, the system can remain exposed unless additional remediation steps are taken.

More than 400 servers have already been compromised around the world, with initial reports starting at 75 and rising steadily. Targeted organizations include government agencies, educational institutions, financial firms, energy providers, and telecom operators. These attacks are not random; they are calculated efforts to exploit high-value systems holding sensitive data.

Microsoft 365’s SharePoint Online is not affected by these vulnerabilities. The risk applies only to on-premises deployments. Systems that have not been fully patched and properly remediated remain vulnerable. If your SharePoint environment is still on-premises and unpatched, it may already be compromised. The threat is active, precise, and built to persist beyond surface-level fixes.

Urgent Action Plan for Securing On-Premises SharePoint

Organizations using on-premises SharePoint must act quickly to counter active threats. The following structured response can help mitigate risks, prevent further compromise, and restore control over affected systems.

1. Apply Security Updates Without Delay

   Microsoft’s July 2025 security patches are the first line of defense. These updates are available for:

   • SharePoint Subscription Edition
   • SharePoint Server 2019

   Until these are installed, systems remain vulnerable to known exploits already being used in active attacks.

2. Strengthen System Defenses

   Security hardening must follow patching.

   • Enable Antimalware Scan Interface (AMSI) in full mode to detect and block obfuscated threats.
   • Deploy Microsoft Defender Antivirus or an equivalent solution across all SharePoint servers to monitor and stop post-exploitation activity.

3. Rotate Keys and Remove Persistence

   Patching alone is not enough. Organizations must rotate the cryptographic keys used to validate SharePoint authentication tokens.

   • Update the ValidationKey and DecryptionKey immediately after patching.
   • Search for and remove any malicious web shells planted during the attack.
   • Restart Internet Information Services (IIS) services to fully clear unauthorized access paths.

4. Perform Threat Hunting and Continuous Monitoring

   Use Microsoft’s published indicators of compromise (IOCs) and scanning tools to assess your environment.

   • Look for signs of prior intrusion or tampering.
   • Isolate any affected hosts to prevent lateral movement or further damage.

By following this structured approach, organizations can minimize exposure, address current threats, and prevent future incidents tied to these SharePoint vulnerabilities.

Zero-Day Threats Make Staying On-Premises a Risk

The latest SharePoint zero-day exploit directly targets on-premises environments, exposing organizations to token forgery, privilege escalation, and persistent access even after patching. These attacks bypass standard defenses and require more than routine updates to mitigate.

Continuing to rely on legacy deployments like SharePoint 2019, which exits mainstream support in July 2026, only increases this risk. While upgrading to SharePoint Subscription Edition ensures ongoing patching, the safer long-term move is to migrate to SharePoint Online. It is unaffected by the current exploit, benefits from continuous updates, and removes the need to manage vulnerable infrastructure.

Apps4Rent for SharePoint: From Emergency Fixes to Cloud Migrations

Apps4Rent brings over two decades of SharePoint experience and, as a Microsoft Solutions Partner, helps organizations respond quickly in the face of active threats. We assist with immediate actions such as deploying security patches, rotating compromised MachineKeys, and performing thorough post-compromise cleanup to eliminate backdoors and persistent access points.

For longer-term protection and sustainability, we offer expert SharePoint migration services, including upgrades to SharePoint Subscription Edition and full migrations to SharePoint Online. Our team delivers end-to-end assistance with planning, implementation, governance, and licensing to ensure your SharePoint environment remains secure, compliant, and aligned with future business goals.

Delay Is the Real Threat: Lock Down SharePoint Without Hesitation

The SharePoint attacks happening now are not theoretical. They are coordinated, targeted intrusions already affecting organizations worldwide. Every day of inaction increases the risk of stolen machine keys, hidden web shells, and full system compromise. On-premises SharePoint environments, once seen as stable, have become high-risk liabilities.

If your organization is still running SharePoint 2016, 2019, or Subscription Edition on-prem, the time to act is now. Whether you’re planning to upgrade your environment or move to SharePoint Online, Apps4Rent can help you execute that transition quickly and securely. Contact us now to secure your infrastructure and start your move toward a stronger, more secure SharePoint future.