As reported by BleepingComputer, CISA has issued an urgent advisory warning that attackers are actively exploiting three vulnerabilities in on-premises Microsoft SharePoint Server installations. This isn't a theoretical risk — confirmed in-the-wild exploitation means organizations still running legacy SharePoint infrastructure have a shrinking window to act.
Why This Matters Now
On-premises SharePoint deployments represent one of the most enticing targets in enterprise environments. These systems frequently sit at the intersection of sensitive document repositories, identity infrastructure, and internal business workflows. A compromised SharePoint server isn't just a data breach — it's often a pivot point into Active Directory, file shares, and downstream SaaS integrations. The fact that CISA is calling this out as actively exploited means threat actors have already operationalized these vulnerabilities, likely across multiple campaigns.
The timing is also significant. Many organizations that haven't yet migrated to SharePoint Online (Microsoft 365) are often running older, under-resourced environments — exactly the kind of systems where patch cycles slip and exposure windows widen. Threat actors know this calculus well.
Who Is Most at Risk
The Broader Threat Landscape Context
SharePoint has historically been a high-value target for both nation-state actors and ransomware groups. We've observed it appear in intrusion chains linked to initial access brokers who sell footholds into corporate networks. When CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — which triggers mandatory patching timelines for federal agencies — the private sector should treat it as equally urgent guidance, not a government-only concern.
Internet-exposed on-premises SharePoint is not just a legacy tech problem — it's an active attack surface that adversaries are exploiting right now. Every day of delay increases your risk of compromise.
It's also worth noting that exploit code for SharePoint vulnerabilities frequently surfaces publicly within days of patch releases, dramatically accelerating the window between disclosure and mass exploitation. Organizations cannot afford a standard 30-day patching cycle for critical, internet-facing systems like this.
Detection Considerations
Beyond patching, defenders should be actively hunting for signs of post-exploitation activity. SharePoint compromises often involve web shell deployment, suspicious w3wp.exe process activity, and unusual outbound connections from the SharePoint server itself. If you have SIEM visibility into your SharePoint infrastructure, now is the time to review recent logs for anomalies — particularly any unexpected file creation in web-accessible directories or lateral movement attempts originating from the SharePoint host.
Shield53 Recommendations
Immediate Actions
- Patch immediately: Apply all available Microsoft security updates for your SharePoint Server version. Prioritize any patches released in the last 90 days and verify your current patch level against Microsoft's Security Update Guide.
- Audit internet exposure: Identify every SharePoint instance accessible from the public internet. If direct internet exposure isn't operationally required, place instances behind a VPN or reverse proxy with strong authentication immediately.
- Enable Web Application Firewall (WAF) rules: Deploy or update WAF rules specifically targeting SharePoint exploit patterns. Cloud-based WAF providers have likely already pushed relevant signatures.
- Review authentication logs: Look for brute force attempts, unusual authentication patterns, or access from unexpected geographies or IP ranges in the last 30–60 days.
- Hunt for web shells: Scan SharePoint server directories for recently created or modified .aspx, .ashx, or .asmx files that shouldn't be there. Tools like Microsoft's Safety Scanner can assist.
- Accelerate cloud migration planning: If you're running on-premises SharePoint primarily due to inertia rather than strict compliance requirements, now is an appropriate time to revisit the migration timeline with leadership.
Longer-Term Posture
- Implement a formal patch SLA for internet-facing systems that is significantly shorter than your internal patching cadence — we recommend 72 hours for Critical/High severity CVEs on externally exposed assets.
- Ensure your EDR solution covers SharePoint servers explicitly and that alerts from these systems are treated as high priority in your SOC workflow.
- Consider threat modeling your SharePoint environment as a critical asset requiring the same security controls as your domain controllers.
The message from CISA is clear. The message from Shield53 is the same: if you're running on-premises SharePoint exposed to the internet and haven't patched, you are a target — potentially already compromised. Act now.
