Overview

• Microsoft released emergency security updates for SharePoint Subscription Edition and SharePoint 2019 on July 20, urging administrators to install them immediately or disconnect vulnerable servers from the internet
• SharePoint 2016 remains exposed as Microsoft continues work on a dedicated patch for that older version
• CISA added CVE-2025-53770 and CVE-2025-53771 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to complete patching by July 21
• The FBI is coordinating with CISA, Microsoft and private-sector partners on incident response and global threat mitigation
• Attackers exploiting the zero-day flaw have bypassed MFA and SSO controls to exfiltrate data, deploy persistent backdoors and steal cryptographic keys on tens of thousands of on-premises servers