{"id":352714,"date":"2025-07-24T11:38:32","date_gmt":"2025-07-24T15:38:32","guid":{"rendered":"https:\/\/msftnewsnow.com\/?p=352714"},"modified":"2025-07-24T11:41:19","modified_gmt":"2025-07-24T15:41:19","slug":"sharepoint-zero-day-attacks-surge-over-400-orgshit","status":"publish","type":"post","link":"https:\/\/msftnewsnow.com\/sharepoint-zero-day-attacks-surge-over-400-orgshit\/","title":{"rendered":"SharePoint Zero-Day Attacks Surge: Over 400 Organizations Breached Amid Critical Microsoft Vulnerabilities"},"content":{"rendered":"
\n
\n

A wave of cyberattacks linked to Chinese-backed threat actors<\/a> is sweeping across global enterprises, exploiting multiple zero-day vulnerabilities in Microsoft SharePoint<\/a>. These coordinated attacks\u2014leveraging CVE-2025-49704, CVE-2025-49706, and newly identified patch bypasses CVE-2025-53770 and CVE-2025-53771\u2014are fueling both ransomware outbreaks and strategic espionage campaigns. At least 400 organizations have been breached as of July 24, 2025 (via Bloomberg<\/em><\/a>), with high-profile targets including the U.S. Nuclear Agency<\/a>, critical infrastructure, and major enterprises.<\/p>\n

SharePoint Zero-Day Vulnerabilities Involved<\/strong><\/h2>\n

\"SharePoint<\/a><\/p>\n

 <\/p>\n

Recent investigations have uncovered four critical flaws at the heart of this campaign:<\/p>\n

\n
\n\n\n\n\n\n\n\n\n
CVE-ID<\/th>\nDescription<\/th>\nPatch Status<\/th>\n<\/tr>\n<\/thead>\n
CVE-2025-49704<\/td>\nRemote code execution in SharePoint<\/td>\nPatch released, but exploits continue<\/td>\n<\/tr>\n
CVE-2025-49706<\/td>\nAuthentication bypass vulnerability<\/td>\nPatch released, attackers still active<\/td>\n<\/tr>\n
CVE-2025-53770<\/td>\nPatch bypass for previous zero-days<\/td>\nNo comprehensive fix<\/td>\n<\/tr>\n
CVE-2025-53771<\/td>\nImproper validation enabling privilege escalation<\/td>\nNo comprehensive fix<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

These loopholes allow attackers to:<\/p>\n