Microsoft has issued an urgent security warning following an active cyberattack targeting on-premise SharePoint servers used by governments, businesses, and institutions worldwide.
The tech giant confirmed that a zero-day vulnerability (CVE‑2025‑53770) is being exploited by hackers to gain unauthorised access and execute code remotely.
“This flaw allows attackers to take control of servers without needing login credentials,” Microsoft said in its advisory.
At least 75 servers have already been compromised globally, including those operated by U.S. federal agencies, universities, and energy companies.
Security firm Eye Security reported that attackers are using a malicious web shell named spinstall0.aspx to maintain persistent access.
Microsoft stated that SharePoint Online (cloud) is not affected, but advised users of SharePoint Server 2016, 2019, and Subscription Edition to immediately apply available patches or disconnect exposed systems from the internet if updates aren’t possible.
Emergency patches have been released for SharePoint Server 2019 and Subscription Edition, while a fix for SharePoint Server 2016 is still pending.
The attack is under investigation by Microsoft, the FBI, and other cybersecurity agencies.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to take action within 24 hours of patch release.
Nigerian organisations using SharePoint for internal operations have been advised to check their systems and strengthen their security protocols.
Experts recommend enabling AMSI (Antimalware Scan Interface), rotating ASP.NET machine keys, and conducting forensic scans for indicators of compromise such as suspicious HTTP requests and unauthorized file uploads.
The exploit, dubbed “ToolShell,” is a variant of a previously patched vulnerability demonstrated at the Pwn2Own Berlin hacking contest in May 2025.
Attackers are now bypassing earlier fixes to steal cryptographic keys and impersonate legitimate users.
Is your organisation prepared to defend against zero-day threats like this one?Rate, Like 👍, Comment💬, share this article, Follow us on our social media handles, and Submit your own story to get featured and earn rewards!
WhatsApp Channel
Telegram Channel
