Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers

Microsoft's on-premises SharePoint Server is currently under "active, large-scale" exploitation due to a critical zero-day vulnerability (CVE-2025-53770, CVSS 9.8) that allows unauthenticated remote code execution. This deserialization flaw enables attackers to steal machine keys for persistent access and lateral movement, with over 85 servers across 29 multinational firms and government entities already compromised. While SharePoint Online is unaffected, Microsoft is preparing a patch and advises immediate mitigations like Antimalware Scan Interface (AMSI) integration or server disconnection, as stolen cryptographic secrets complicate remediation even after a patch is applied.

Analysis

A critical zero-day vulnerability (CVE-2025-53770) with a CVSS score of 9.8 is being actively exploited in Microsoft's on-premises SharePoint Server, creating significant risk for enterprise and government clients. The flaw allows for unauthenticated remote code execution, with attackers already compromising over 85 servers across 29 organizations by stealing cryptographic keys to establish persistent, difficult-to-detect access. While Microsoft (MSFT) is developing a patch, its current mitigation advice—such as disconnecting servers from the internet—is operationally disruptive. A key concern is that a future patch may not be sufficient for remediation, as stolen keys would not be rotated, leaving patched systems vulnerable. The financial and reputational impact on Microsoft is somewhat contained because its core, higher-margin SharePoint Online service is unaffected. The incident underscores the systemic importance of advanced cybersecurity, positioning firms like Palo Alto Networks (PANW), which helped identify related threats, as critical ecosystem partners.

Key Decisions for Investors

• Investors in Microsoft should monitor the situation for signs of wider-than-reported exploitation, but the lack of impact on the strategic SharePoint Online service likely contains the direct financial fallout.
• This event reinforces the investment thesis for cybersecurity firms such as Palo Alto Networks, as the complexity of the attack highlights enterprise need for advanced endpoint detection and threat intelligence beyond basic patching.
• The vulnerability may accelerate the migration of customers from on-premises servers to Microsoft's more secure and lucrative cloud offerings, potentially turning a short-term negative event into a long-term strategic benefit for MSFT.
• Traders should be aware of the strongly negative sentiment surrounding MSFT, which could create short-term volatility, while noting the positive sentiment for PANW as it is positioned as part of the solution.