Hackers exploiting SharePoint zero-day seen targeting government agencies

Researchers and CISA report a zero-day (CVE-2025-53770) in on‑premises Microsoft SharePoint is being actively exploited in the wild, with initial attacks apparently targeting government agencies, universities and critical infrastructure organizations; analysts found between 8,000–10,000 internet-accessible vulnerable SharePoint instances and warn that exploitation may expand as more attackers reuse the flaw. Microsoft advises applying patches or disconnecting affected on-prem servers from the internet.