Microsoft Issues Alert over Zero-Day Attacks

• 21 Jul 2025

On 21st July 2025, Microsoft issued an urgent security alert about active cyberattacks targeting SharePoint servers used by government agencies and businesses to share internal documents.

Key Points

• Zero-Day Vulnerability: The attacks exploited a previously unknown flaw—known as a “zero day”—allowing attackers to perform spoofing over a network.
• Targeted Systems: Only on-premises SharePoint Server installations are affected. Microsoft 365 SharePoint Online is not impacted.
• Spoofing Risk: Attackers could impersonate trusted entities, potentially manipulating financial or official systems.
• Urgent Patch Required: Microsoft has issued security updates and strongly recommended customers install them immediately.
• Versions Affected: The flaw affects SharePoint 2016 and 2019. Updates are being rolled out for these versions.
• Offline Precaution: Customers unable to apply protections are advised to disconnect servers from the internet until fixes are applied.
• FBI & Global Coordination: The FBI acknowledged the attack and is working with federal and private partners. Microsoft is also collaborating with CISA, DOD Cyber Defense Command, and global cybersecurity agencies.