Microsoft (MSFT, Financial) has announced the release of critical security updates targeting vulnerabilities in on-premises SharePoint servers. These updates, issued on July 19, 2025, address active security threats linked to two main vulnerabilities: CVE-2025-49706, a spoofing vulnerability, and CVE-2025-49704, a remote code execution vulnerability. Importantly, these issues do not impact SharePoint Online in Microsoft 365.
The company urges customers to implement these updates without delay to safeguard their systems. The patches also cover new security vulnerabilities, specifically CVE-2025-53770, related to the previously identified CVE-2025-49704, and CVE-2025-53771 concerning CVE-2025-49706.
Microsoft has identified two Chinese nation-state actors, referred to as Linen Typhoon and Violet Typhoon, along with another China-based group called Storm-2603, as exploiting these vulnerabilities in internet-facing SharePoint servers. The company warns that the adoption of these exploits is rising and anticipates that more threat actors will use them against unpatched systems. Microsoft continues to investigate the situation and plans to provide updates as more information becomes available.
