Outbreak Alert: Microsoft SharePoint Zero-day Attack

[smallick]

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2025-53771
CVE Title	Improper limitation of a pathname to a restricted directory ('path...
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	90/100
Epss Score	0.00127
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	No
Available working exploit(s)	0
Available POC exploit(s)	0
Darknet Mention(s)	0
Telegram Mention(s)	1 (SecAtor)
FortiRecon Intelligence Reporting(s)	0
Vendor Advisory:	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771 https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attac...

CVE ID	CVE-2025-53770
CVE Title	Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.0304
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	20
Darknet Mention(s)	0
Telegram Mention(s)	2 (SecAtor, Ralf Hacker Channel)
FortiRecon Intelligence Reporting(s)	0
Vendor Advisory:	https://news.ycombinator.com/item?id=44629710 https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attac... https://x.com/Shadowserver/status/1946900837306868163 https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-... https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-too... https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoi... https://research.eye.security/sharepoint-under-siege/ https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally https://github.com/kaizensecurity/CVE-2025-53770 https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attac... https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-5377...

CVE ID	CVE-2025-49706
CVE Title	Microsoft SharePoint Improper Authentication Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.00044
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	3
Darknet Mention(s)	0
Telegram Mention(s)	1 (SecAtor)
FortiRecon Intelligence Reporting(s)	0
Vendor Advisory:	https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premis... https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706

CVE ID	CVE-2025-49704
CVE Title	Microsoft SharePoint Code Injection Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	90/100
Epss Score	0.00296
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	0
Darknet Mention(s)	0
Telegram Mention(s)	2 (SecAtor)
FortiRecon Intelligence Reporting(s)	0
Vendor Advisory:	https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premis... https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704