Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-4428+1 related CVE | Authenticated Code Injection RCE in Ivanti Endpoint Manager Mobile (EPMM) API | 8.8 group max | 88% | KEV | KEV |
CVE-2025-49704+1 related CVE | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 group max | 100% | KEVRansomware | KEV |
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing | 6.5 | 100% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.238.159.149 | tion efforts originated from three different IP addresses – 104.238.159[.]149, 107.191.58[.]76, and 96.9.125[.]147 – one of which was p |
| ipv4 | 107.191.58.76 | ated from three different IP addresses – 104.238.159[.]149, 107.191.58[.]76, and 96.9.125[.]147 – one of which was previously tied to |
| ipv4 | 96.9.125.147 | rent IP addresses – 104.238.159[.]149, 107.191.58[.]76, and 96.9.125[.]147 – one of which was previously tied to the weaponization o |
From the original article
5 min read at thehackernews.com
The recently disclosed critical Microsoft SharePoint vulnerability has been under exploitation as early as July 7, 2025, according to findings from Check Point Research.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.