If exploited, attackers can gain full access to SharePoint content and potentially pivot to Outlook, Teams, and OneDrive. Learn how to protect your SharePoint server from compromise.

Microsoft has started releasing updates to fix the exploited SharePoint zero-days tracked as CVE-2025-53770 and CVE-2025-53771.

The term "zero-day" attack refers to when a previously unknown vulnerability is targeted. Tens of thousands of servers are said to be at risk. While the issue is serious, it differs from several previous vulnerabilities related to Microsoft. The attack only affects on-premises servers; cloud-based servers are unaffected.