Microsoft has issued a warning about active attacks targeting vulnerabilities in its SharePoint server software.

The flaw is a “zero-day” vulnerability, meaning it was previously unknown and is being exploited before a patch is available.

The FBI has confirmed it is aware of the attacks and is working with federal and private-sector partners.

Experts estimate tens of thousands of servers may be affected.

The attacks impact only on-premises SharePoint servers and do not affect the cloud-based SharePoint Online service.

Microsoft has released a security update for the SharePoint Subscription Edition and is developing updates for the 2016 and 2019 versions.

Organizations unable to apply malware protection are advised to disconnect their servers from the internet until updates are installed.

🔗 Source: Reuters

🧠 Food for thought

1️⃣ Zero-day vulnerabilities continue to pose critical security challenges

This SharePoint attack represents the latest in a concerning pattern of zero-day vulnerabilities being exploited against critical infrastructure.

Zero-day attacks, which target previously unknown vulnerabilities, are particularly dangerous because they exploit security gaps before developers can create patches, giving attackers a significant advantage.

The recommendation to disconnect servers from the internet highlights the severity of this vulnerability, as such drastic measures are typically only suggested when risks are substantial and immediate.

This incident follows several major zero-day exploits in recent years, including the 2020 SolarWinds breach that affected thousands of organizations and multiple federal agencies.

The specific spoofing vulnerability mentioned is particularly concerning as it allows attackers to impersonate trusted entities within organizational networks, potentially enabling them to access sensitive information while appearing legitimate.

2️⃣ The cloud versus on-premises security divide widens

Recent Microsoft developments