CISA Issues Warning on Ongoing Attacks Targeting SharePoint Systems
On July 22, 2025, CISA added two major Microsoft SharePoint flaws — CVE-2025-49704 (remote code execution) and CVE-2025-49706 (authentication bypass) — to its Known Exploited Vulnerabilities list after confirming active use in attacks. Federal agencies were ordered to patch by July 23. Microsoft reported that Chinese hacker groups, Linen Typhoon and Violet Typhoon, have been taking advantage of these bugs since early July using a method called “ToolShell,” which also involves CVE-2025-53770 and CVE-2025-53771.
These flaws allow attackers to install web shells, steal encryption keys, and gather system data. Some malware was disguised as harmless files like “debug.js.” While Microsoft recommends enabling AMSI for protection, researchers found it can be bypassed and stressed that patching is critical. Around 400 organizations are believed to be affected.
Mitigation Steps:
- Keep your system and apps updated
- Avoid suspicious links and unknown files
- Report unusual SharePoint behavior
- Use strong, unique passwords with MFA
- Log out when done, especially on shared devices
- Only use trusted tools and extensions
- Apply the latest security patches for SharePoint Server 2016, 2019, and Subscription Edition immediately.
- Use Microsoft Defender Antivirus or another updated antimalware tool.
- Monitor for suspicious activity, such as unauthorized web shells or renamed executables like "debug.js".
Source: https://thehackernews.com/2025/07/cisa-orders-urgent-patching-after.html