A SharePoint zero-day triggers a global campaign

What happened

On 21 July 2025 researchers identified a campaign against self-managed SharePoint servers that exploited a zero-day vulnerability to gain persistent access, according to Reuters. Microsoft issued alerts and patches; SharePoint Online was not affected by the same flaw.

The campaign was likely attributed to a single initial actor, although thousands of organisations were potentially vulnerable while the flaw remained unpatched and active.

What it means for a mid-sized business

In an on-premise environment, a business retains more control over its infrastructure, but also takes on more responsibility for patching, internet exposure and monitoring. That operational burden needs to be understood and accepted before choosing that technology model, not discovered during an incident.

For many SMEs, the alternative of managed cloud services shifts part of that responsibility to the provider, although it does not eliminate it entirely: access and permissions still need to be properly configured, and the service's own security alerts need to be reviewed.

What to review

Aspects to assess regarding critical on-premise systems:

• Who within the organisation is responsible for applying emergency patches to on-premise systems.
• How long it typically takes between a critical patch being released and actually applied.
• Whether the on-premise system really needs to be accessible from the internet or can be restricted.
• Whether a contingency plan exists if the system must be urgently disconnected due to an active vulnerability.

Frequently Asked Questions

What is a zero-day?

A vulnerability that is exploited before the vendor has published an available fix.

Was SharePoint Online affected?

No; according to available information, the flaw affected self-managed SharePoint servers.

What advantage does a managed service have over on-premise in these cases?

The provider takes on a large share of patching and monitoring responsibility, although the business still needs to configure access and permissions correctly.