New zero-day bug in Microsoft SharePoint under widespread attack

A newly disclosed zero-day vulnerability in on-premises Microsoft SharePoint (CVE-2025-53770) is being actively exploited in the wild, allowing attackers to steal private digital keys, impersonate legitimate requests, deploy malware, and access stored files. CISA issued an alert after security researchers (Eye Security) found dozens of actively exploited servers; Microsoft is developing patches for affected versions including SharePoint Server 2016, and impacted organizations — including U.S. federal agencies, universities, and energy companies — are urged to take immediate actions such as disconnecting exposed systems and rotating keys.