Published by Global Banking & Finance Review®
Posted on July 21, 2025
2 min readLast updated: January 22, 2026
Add as preferred source on GoogleMicrosoft warns of active attacks on SharePoint servers, urging immediate updates to fix a zero day vulnerability affecting businesses and governments.
WASHINGTON (Reuters) -Microsoft has issued an alert about "active attacks" on server software used by government agencies and businesses to share documents within organizations, and recommended security updates that customers should apply immediately.
The FBI said on Sunday it is aware of the attacks and is working closely with its federal and private-sector partners, but offered no other details.
In an alert issued on Saturday, Microsoft said the vulnerabilities apply only to SharePoint servers used within organizations. It said that SharePoint Online in Microsoft 365, which is in the cloud, was not hit by the attacks.
"We've been coordinating closely with CISA, DOD Cyber Defense Command and key cybersecurity partners globally throughout our response," a Microsoft spokesperson said, adding that the company had issued security updates and urged customers to install them immediately.
The Washington Post, which first reported the hacks, said unidentified actors in the past few days had exploited a flaw to launch an attack that targeted U.S. and international agencies and businesses.
The hack is known as a "zero day" attack because it targeted a previously unknown vulnerability, the newspaper said, quoting experts. Tens of thousands of servers were at risk.
In the alert, Microsoft said that a vulnerability "allows an authorized attacker to perform spoofing over a network." It issued recommendations to stop the attackers from exploiting it.
In a spoofing attack, an actor can manipulate financial markets or agencies by hiding the actor's identity and appearing to be a trusted person, organization or website.
Earlier, Microsoft said it is working on updates to 2016 and 2019 versions of SharePoint. If customers cannot enable recommended malware protection, they should disconnect their servers from the internet until a security update is available, it added.
(Reporting by Timothy Gardner in Washington; Editing by Frank McGurty, Leslie Adler and Lincoln Feast.)
Microsoft has issued an alert about active attacks on server software, specifically targeting SharePoint servers used by organizations.
A zero day attack targets a previously unknown vulnerability, which in this case has put tens of thousands of servers at risk.
Microsoft recommends enabling malware protection and disconnecting affected servers from the internet if protection cannot be enabled.
Microsoft is coordinating closely with CISA, DOD Cyber Defense Command, and key cybersecurity partners globally.
The vulnerability allows an authorized attacker to perform spoofing over a network, potentially manipulating financial markets or agencies.
Explore more articles in the Finance category
