Microsoft Sounds Alarm on Active Cyberattacks Targeting SharePoint Servers

The FBI has acknowledged the attacks and is coordinating with federal and private partners. 


Microsoft has issued a high-priority cybersecurity alert, warning of active exploitation of a zero-day vulnerability in its SharePoint Server software. The flaw is being targeted by threat actors in ongoing cyberattacks, primarily affecting on-premise SharePoint servers used by government agencies, large enterprises, and various private organizations for internal collaboration and document sharing.

The zero-day vulnerability—meaning the flaw was exploited before Microsoft could release a fix—poses a significant security risk to tens of thousands of servers globally. Cybercriminals are leveraging this loophole to gain unauthorized access, potentially leading to data theft, system breaches, or even ransomware attacks.

In response to the escalating threat, Microsoft has strongly urged all organizations running on-premise SharePoint Servers to immediately apply the latest security patches and updates. The company emphasized that swift action is necessary to prevent compromise and reduce the risk of broader attacks.

Importantly, Microsoft clarified that SharePoint Online, part of its cloud-based Microsoft 365 suite, remains unaffected by the vulnerability. This distinction offers some relief to organizations operating in cloud environments but increases urgency for those still using traditional, on-premise infrastructure.

The U.S. Federal Bureau of Investigation (FBI) has acknowledged the threat and confirmed its involvement in tracking and mitigating the situation. The FBI is reportedly working closely with federal agencies and private-sector cybersecurity teams to assess the scope and impact of the attacks. However, further details remain undisclosed due to the sensitive nature of the investigations.

This development highlights the growing importance of proactive cybersecurity measures, especially as threat actors increasingly target high-value infrastructure with sophisticated tools. Microsoft recommends enabling automatic updates, conducting regular vulnerability assessments, and following best practices in system hardening and user access control.

Organizations using SharePoint Server are strongly advised to review Microsoft’s security advisory and act immediately to implement the necessary defenses. Ignoring the issue could result in data loss, regulatory consequences, and costly recovery efforts.