Zero-Day Vulnerabilities in Microsoft SharePoint

What’s really going on – and why are even major enterprises struggling to respond?

What’s this all about?

Two critical vulnerabilities in Microsoft SharePoint have recently been uncovered and are attracting significant attention. These are so-called “zero-day exploits” – security gaps that have no fixes available at the time of discovery:

• CVE-2025-53770

• CVE-2025-53771

They allow attackers to bypass authentication entirely, granting access to servers and sensitive data without credentials. That’s what makes them so high-risk.

The Technical Core – Explained Simply

Both vulnerabilities are related to how SharePoint handles login data:

• CVE-2025-53770 opens the door to Remote Code Execution.
  In practical terms: attackers can send commands to your SharePoint server from the outside – and the server executes them, no questions asked.

• CVE-2025-53771 is a Security Feature Bypass.
  In plain English: SharePoint’s built-in defenses fail to notice the intrusion – like a silent alarm that never goes off.

Used together, these two flaws let attackers seize full control of the affected system.

How Are These Vulnerabilities Exploited?

The attackers focus on the SharePoint login interface. They send manipulated requests that disguise harmful code as legitimate traffic. The system doesn’t recognize the threat.

The hackers:

• Send a crafted request that looks like a normal login attempt

• Exploit the flaw that tricks the server into thinking: “Everything’s fine, go ahead and run this code!”

• Gain access to confidential data or admin rights – without a password

Who Was Targeted – and Why It Matters

Over 400 organizations across the globe have already been hit – including high-security entities like the U.S. National Nuclear Security Administration (NNSA), responsible for safeguarding America’s nuclear arsenal.

The attackers focused on government bodies, research centers, IT providers, and other institutions handling highly sensitive or strategic information.

What Data Was Exposed – and What Are the Risks?

Attackers used the exploited SharePoint systems to extract critical information, including:

• Confidential documents: contracts, strategy papers, proprietary business data

• Security-related content: including nuclear safety protocols and procedures

• Personal staff data: login credentials and employee identities

The full impact is still being assessed. But the nature of the stolen data points to serious risks – from corporate espionage to breaches of national security.

How High Are the Damages and the Effort Involved?

Incidents like these often result in damages running into the millions. Direct costs include forensic analysis, rebuilding compromised infrastructure, and rotating authentication mechanisms. Comparable breaches have cost affected companies several million euros – and that’s without accounting for:

• Loss of customer and partner trust

• Long-term brand damage

• Regulatory penalties under data protection laws

Why Couldn’t Large Organizations Like the U.S. Nuclear Agency Stop This?

Zero-day flaws are unknown until they’re exploited – that’s what makes them so dangerous. Even well-funded, security-conscious organizations are exposed because:

• There are no defenses against something you don’t know exists

• No vendor patch is available at the time

• Attackers move fast – often within hours of the discovery

The result: even the best-prepared systems can be caught off guard.

How Can You Protect Yourself – and What Are Affected Organizations Doing Now?

Zero-day attacks can’t always be prevented – but their impact can be reduced:

• Apply security patches immediately (Microsoft has released updates)

• Restrict access to login portals – allow only trusted IPs and networks

• Use multi-factor authentication (2FA) wherever possible

• Take vulnerable SharePoint instances offline if compromise is suspected

Organizations hit by the attack are responding by:

• Monitoring for abnormal behavior on affected systems

• Isolating compromised infrastructure

• Resetting all credentials and security tokens

• Investigating the scope of the breach with forensic tools

Why Do Vulnerabilities Like This Exist?

Large-scale platforms like SharePoint are built on millions of lines of code. With that level of complexity, mistakes are inevitable – even for vendors like Microsoft. Gaps in testing or overlooked edge cases can lead to serious vulnerabilities.

And attackers know that. Zero-day flaws are a goldmine for cybercriminals – used for theft, blackmail, or strategic spying.

Further Reading and Sources:

Microsoft Security Response Center (MSRC)
CISA Security Advisories
Tom’s Guide – Simple explanation of the vulnerabilities