{"id":27800,"date":"2025-07-22T16:54:39","date_gmt":"2025-07-22T14:54:39","guid":{"rendered":"https:\/\/perseus.de\/critical-vulnerability-in-microsoft-sharepoint\/"},"modified":"2026-03-31T07:15:34","modified_gmt":"2026-03-31T05:15:34","slug":"critical-vulnerability-in-microsoft-sharepoint","status":"publish","type":"post","link":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/","title":{"rendered":"Critical vulnerability in Microsoft SharePoint"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"27800\" class=\"elementor elementor-27800 elementor-24743\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dcf4ec4 e-flex e-con-boxed e-con e-parent\" data-id=\"dcf4ec4\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e1db58c elementor-widget elementor-widget-image\" data-id=\"e1db58c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"800\" height=\"200\" src=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\" class=\"attachment-large size-large wp-image-27799\" alt=\"\" srcset=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png 1024w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-300x75.png 300w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-768x192.png 768w, https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png 1200w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1258a43 e-flex e-con-boxed e-con e-parent\" data-id=\"1258a43\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-2de4e88 e-con-full e-flex e-con e-child\" data-id=\"2de4e88\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4982c80 elementor-widget elementor-widget-text-editor\" data-id=\"4982c80\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h6>21.07.2025<\/h6>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8348bc5 elementor-widget elementor-widget-heading\" data-id=\"8348bc5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Critical vulnerability in Microsoft SharePoint  \n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-eb03842 e-con-full e-flex e-con e-child\" data-id=\"eb03842\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-91d0988 elementor-widget elementor-widget-text-editor\" data-id=\"91d0988\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">We would like to draw your attention to a currently exploited<\/span><b> security vulnerability in Microsoft SharePoint <\/b><span style=\"font-weight: 400;\">, which poses considerable risks for systems operated exclusively locally (&#8220;on-premises&#8221;). <\/span> <\/p><p><span style=\"font-weight: 400;\">The<\/span><a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770\"><span style=\"font-weight: 400;\"> U.S. cybersecurity agency CISA<\/span><\/a><span style=\"font-weight: 400;\"> and Microsoft itself report <\/span><b>active attacks on systems<\/b> that <span style=\"font-weight: 400;\">exploit the CVE-2025-53770 vulnerability \u2013 also <\/span><a href=\"https:\/\/www.heise.de\/news\/Kritische-Sharepoint-Sicherheitsluecke-Erste-Patches-fuer-ToolShell-sind-da-10493989.html\"><span style=\"font-weight: 400;\">known as &#8220;ToolShell&#8221;.<\/span><\/a><span style=\"font-weight: 400;\"> Below you will find an overview of the incident as well as concrete measures you can take to secure your systems.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ceb0f40 e-flex e-con-boxed e-con e-parent\" data-id=\"ceb0f40\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ffbdc12 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"ffbdc12\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-02dd0e9 e-flex e-con-boxed e-con e-parent\" data-id=\"02dd0e9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-16d621d e-con-full e-flex e-con e-child\" data-id=\"16d621d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-89904c7 elementor-widget elementor-widget-text-editor\" data-id=\"89904c7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>What happened?<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fae461d e-con-full e-flex e-con e-child\" data-id=\"fae461d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0f04793 elementor-widget elementor-widget-text-editor\" data-id=\"0f04793\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">The <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-53770\"><span style=\"font-weight: 400;\">CVE-2025-53770 vulnerability<\/span><\/a><span style=\"font-weight: 400;\"> allows attackers to access SharePoint servers without logging in (&#8220;unauthenticated&#8221;) and <\/span><b>to execute arbitrary code over the network (= RCE \u2192 Remote Code Execution).<\/b><span style=\"font-weight: 400;\"> It is a variant of the already known <\/span><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-49706\"><span style=\"font-weight: 400;\">CVE-2025-49706<\/span><\/a> vulnerability <span style=\"font-weight: 400;\"> and is based on faulty <\/span><b>deserialization<\/b><span style=\"font-weight: 400;\"> \u2013 a technical process in which data is converted into a readable format. If this is insufficiently secured, malicious code can be introduced and executed.<\/span><\/p><p><span style=\"font-weight: 400;\">The attackers can gain complete access to the server and then to the infrastructure behind it, including file storage, configuration, and sensitive content. The incident only affects <\/span><b>local SharePoint installations<\/b><span style=\"font-weight: 400;\"> \u2013 <\/span><b>SharePoint Online (Microsoft 365) is not affected, according to Microsoft<\/b><span style=\"font-weight: 400;\">.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-174b215 e-flex e-con-boxed e-con e-parent\" data-id=\"174b215\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-e560a6b e-con-full e-flex e-con e-child\" data-id=\"e560a6b\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-013b67e elementor-widget elementor-widget-text-editor\" data-id=\"013b67e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>What is affected?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a72ed48 e-con-full e-flex e-con e-child\" data-id=\"a72ed48\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-db8754f elementor-widget elementor-widget-text-editor\" data-id=\"db8754f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">The vulnerability only affects companies that <\/span> operate <b>Microsoft SharePoint locally (on-premises<\/b><span style=\"font-weight: 400;\">).<\/span><\/p><p><span style=\"font-weight: 400;\">Specifically, the following versions are at risk:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">SharePoint Server 2016<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">SharePoint Server 2019<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">SharePoint Subscription Edition (if not patched)<\/span><\/li><\/ul><p> <\/p><p><span style=\"font-weight: 400;\">The cloud version SharePoint Online, which runs on Microsoft 365, is not affected.<\/span><\/p><p><span style=\"font-weight: 400;\">The situation is particularly critical if affected servers are directly accessible via the Internet and important protective measures or updates are missing.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-da9fcac e-flex e-con-boxed e-con e-parent\" data-id=\"da9fcac\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-70aad00 e-con-full e-flex e-con e-child\" data-id=\"70aad00\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-55be951 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"55be951\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d3f9227 e-flex e-con-boxed e-con e-parent\" data-id=\"d3f9227\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-6059711 e-con-full e-flex e-con e-child\" data-id=\"6059711\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-26eea72 elementor-widget elementor-widget-text-editor\" data-id=\"26eea72\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>How can I protect myself?<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-724b6c6 e-con-full e-flex e-con e-child\" data-id=\"724b6c6\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f0c2fb4 elementor-widget elementor-widget-text-editor\" data-id=\"f0c2fb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ol><li> <span style=\"font-weight: 400;\"> Install security updates: <\/span><a href=\"https:\/\/msrc.microsoft.com\/blog\/2025\/07\/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770\/\"><span style=\"font-weight: 400;\">Microsoft has now released patches<\/span><\/a><span style=\"font-weight: 400;\"> for SharePoint 2019 (patch with the identifier KB5002754) and the Subscription Edition (patch with the identifier KB 5002768). The security update for SharePoint 2016 is currently still in progress. In this case, it is recommended to take immediate protective measures (see below) until the update is released and to install Microsoft&#8217;s July security updates at the same time. <\/span> <\/li><\/ol><p> <\/p><ol start=\"2\"><li> <span style=\"font-weight: 400;\"> Rotate machine keys: After installing the updates, the so-called ASP.NET <\/span><b>machine keys<\/b> must <span style=\"font-weight: 400;\"> be renewed. These keys are essential for secure communication between system components. Rotation is done via PowerShell or via SharePoint Central Administration. Then a restart of the IIS web server is required.<\/span><span style=\"font-weight: 400;\"><br><br><\/span><\/li><li><span style=\"font-weight: 400;\">  Enable Antimalware Scan Interface (AMSI): AMSI detects and blocks suspicious scripts at runtime. Make sure AMSI is enabled correctly. This should be enabled by default since September 2023.  <\/span><span style=\"font-weight: 400;\"><br><br><\/span><\/li><li><span style=\"font-weight: 400;\">  Use Microsoft Defender Antivirus and Defender for Endpoint: These security solutions detect known attack patterns and block related activities. Alternatively, comparable endpoint detection and response (EDR) solutions can be used. <\/span><span style=\"font-weight: 400;\"><br><br><\/span><\/li><li><span style=\"font-weight: 400;\">  Disconnect emergency systems from the network (if AMSI cannot be activated): If AMSI cannot be activated, CISA recommends that public systems be temporarily disconnected from the Internet.<\/span><span style=\"font-weight: 400;\"><br><br><\/span><\/li><li><span style=\"font-weight: 400;\">  Ensure logging &amp; monitoring: Enable comprehensive logging (event logging) to track unusual behavior. In particular, monitor POST requests to suspicious paths. <\/span><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-65d84f2 e-flex e-con-boxed e-con e-parent\" data-id=\"65d84f2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-3c936a5 e-con-full e-flex e-con e-child\" data-id=\"3c936a5\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3bbb54c elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"3bbb54c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-36d5f66 e-flex e-con-boxed e-con e-parent\" data-id=\"36d5f66\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-60eb6a0 elementor-widget elementor-widget-heading\" data-id=\"60eb6a0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">From experts for experts:<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-092ac14 elementor-widget elementor-widget-text-editor\" data-id=\"092ac14\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>IT managers should check the following attack patterns in particular:<\/strong><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Presence of the file: \/_layouts\/15\/ToolPane.aspx? DisplayMode=Edit<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Accesses from the following IP addresses: 107.191.58[.]76, 104.238.159[.]149, 96.9.125[.]147<\/span><span style=\"font-weight: 400;\"><br><\/span><span style=\"font-weight: 400;\"> (in particular between 18 and 19 July 2025)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Alerts in Microsoft Defender such as:<\/span><span style=\"font-weight: 400;\"><br><\/span><span style=\"font-weight: 400;\">&#8220;Possible web shell installation&#8221;<\/span><span style=\"font-weight: 400;\"><br><\/span><span style=\"font-weight: 400;\">&#8220;Suspicious IIS worker process behavior&#8221;<\/span><span style=\"font-weight: 400;\"><br><\/span><span style=\"font-weight: 400;\">&#8220;HijackSharePointServer&#8221; or &#8220;SuspSignoutReq&#8221; malware detected<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-dcff67d e-flex e-con-boxed e-con e-parent\" data-id=\"dcff67d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-ad15629 e-con-full e-flex e-con e-child\" data-id=\"ad15629\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dd3e115 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"dd3e115\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>There is a critical vulnerability in Microsoft Windows (CVSS 9.8) that affects almost all current Windows and server versions and allows attackers to execute malicious code with system privileges without user interaction \u2013 an acute risk to your IT infrastructure<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[64],"tags":[],"class_list":["post-27800","post","type-post","status-publish","format-standard","hentry","category-hazard-warning"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Critical vulnerability in Microsoft SharePoint - Perseus Technologies<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Critical vulnerability in Microsoft SharePoint - Perseus Technologies\" \/>\n<meta property=\"og:description\" content=\"There is a critical vulnerability in Microsoft Windows (CVSS 9.8) that affects almost all current Windows and server versions and allows attackers to execute malicious code with system privileges without user interaction \u2013 an acute risk to your IT infrastructure\" \/>\n<meta property=\"og:url\" content=\"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/\" \/>\n<meta property=\"og:site_name\" content=\"Perseus Technologies\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-22T14:54:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-31T05:15:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Xenia Silbe\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xenia Silbe\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/\"},\"author\":{\"name\":\"Xenia Silbe\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/person\\\/42cdb0ff9720a4c92a2613f686b32f46\"},\"headline\":\"Critical vulnerability in Microsoft SharePoint\",\"datePublished\":\"2025-07-22T14:54:39+00:00\",\"dateModified\":\"2026-03-31T05:15:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/\"},\"wordCount\":528,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"articleSection\":[\"Hazard warning\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/\",\"url\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/\",\"name\":\"Critical vulnerability in Microsoft SharePoint - Perseus Technologies\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"datePublished\":\"2025-07-22T14:54:39+00:00\",\"dateModified\":\"2026-03-31T05:15:34+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/#primaryimage\",\"url\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\",\"contentUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/perseus.de\\\/en\\\/critical-vulnerability-in-microsoft-sharepoint\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/perseus.de\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Critical vulnerability in Microsoft SharePoint\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#website\",\"url\":\"https:\\\/\\\/perseus.de\\\/\",\"name\":\"perseus-web.de\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/perseus.de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#organization\",\"name\":\"perseus-web.de\",\"url\":\"https:\\\/\\\/perseus.de\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/PerseusTechnologie_Color-2.png\",\"contentUrl\":\"https:\\\/\\\/perseus.de\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/PerseusTechnologie_Color-2.png\",\"width\":536,\"height\":172,\"caption\":\"perseus-web.de\"},\"image\":{\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/perseus.de\\\/#\\\/schema\\\/person\\\/42cdb0ff9720a4c92a2613f686b32f46\",\"name\":\"Xenia Silbe\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g\",\"caption\":\"Xenia Silbe\"},\"sameAs\":[\"https:\\\/\\\/perseus.de\\\/\"],\"url\":\"https:\\\/\\\/perseus.de\\\/en\\\/author\\\/xenia-silbe\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Critical vulnerability in Microsoft SharePoint - Perseus Technologies","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/","og_locale":"en_US","og_type":"article","og_title":"Critical vulnerability in Microsoft SharePoint - Perseus Technologies","og_description":"There is a critical vulnerability in Microsoft Windows (CVSS 9.8) that affects almost all current Windows and server versions and allows attackers to execute malicious code with system privileges without user interaction \u2013 an acute risk to your IT infrastructure","og_url":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/","og_site_name":"Perseus Technologies","article_published_time":"2025-07-22T14:54:39+00:00","article_modified_time":"2026-03-31T05:15:34+00:00","og_image":[{"width":1200,"height":300,"url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025.png","type":"image\/png"}],"author":"Xenia Silbe","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Xenia Silbe","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/#article","isPartOf":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/"},"author":{"name":"Xenia Silbe","@id":"https:\/\/perseus.de\/#\/schema\/person\/42cdb0ff9720a4c92a2613f686b32f46"},"headline":"Critical vulnerability in Microsoft SharePoint","datePublished":"2025-07-22T14:54:39+00:00","dateModified":"2026-03-31T05:15:34+00:00","mainEntityOfPage":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/"},"wordCount":528,"commentCount":0,"publisher":{"@id":"https:\/\/perseus.de\/#organization"},"image":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/#primaryimage"},"thumbnailUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","articleSection":["Hazard warning"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/","url":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/","name":"Critical vulnerability in Microsoft SharePoint - Perseus Technologies","isPartOf":{"@id":"https:\/\/perseus.de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/#primaryimage"},"image":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/#primaryimage"},"thumbnailUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","datePublished":"2025-07-22T14:54:39+00:00","dateModified":"2026-03-31T05:15:34+00:00","breadcrumb":{"@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/#primaryimage","url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png","contentUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/04\/Gefahrenwarnung-Headerbild-Website-2025-1024x256.png"},{"@type":"BreadcrumbList","@id":"https:\/\/perseus.de\/en\/critical-vulnerability-in-microsoft-sharepoint\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/perseus.de\/"},{"@type":"ListItem","position":2,"name":"Critical vulnerability in Microsoft SharePoint"}]},{"@type":"WebSite","@id":"https:\/\/perseus.de\/#website","url":"https:\/\/perseus.de\/","name":"perseus-web.de","description":"","publisher":{"@id":"https:\/\/perseus.de\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/perseus.de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/perseus.de\/#organization","name":"perseus-web.de","url":"https:\/\/perseus.de\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/perseus.de\/#\/schema\/logo\/image\/","url":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/03\/PerseusTechnologie_Color-2.png","contentUrl":"https:\/\/perseus.de\/wp-content\/uploads\/2025\/03\/PerseusTechnologie_Color-2.png","width":536,"height":172,"caption":"perseus-web.de"},"image":{"@id":"https:\/\/perseus.de\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/perseus.de\/#\/schema\/person\/42cdb0ff9720a4c92a2613f686b32f46","name":"Xenia Silbe","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ad1725c4df9d407f031b1429111650ed671361b6db97d9353d2b0d1aea2f67ed?s=96&d=mm&r=g","caption":"Xenia Silbe"},"sameAs":["https:\/\/perseus.de\/"],"url":"https:\/\/perseus.de\/en\/author\/xenia-silbe\/"}]}},"_links":{"self":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27800","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/comments?post=27800"}],"version-history":[{"count":1,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27800\/revisions"}],"predecessor-version":[{"id":27801,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/posts\/27800\/revisions\/27801"}],"wp:attachment":[{"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/media?parent=27800"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/categories?post=27800"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/perseus.de\/en\/wp-json\/wp\/v2\/tags?post=27800"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}