The SharePoint attacks: legacy servers are a liability
A flaw in self-hosted SharePoint let attackers break into organisations around the world before a fix existed. Systems you run yourself need the most attention.
By the Xuru Technologies team · 22 July 2025
Key takeaways
- From around 18–19 July 2025, attackers exploited a critical vulnerability (CVE-2025-53770, "ToolShell") in on-premises SharePoint Server.
- SharePoint Online in Microsoft 365 was not affected.
- Attackers stole cryptographic keys that could allow continued access even after patching, so key rotation was needed.
- Internet-facing systems you host yourself need fast patching, monitoring and a plan to retire them.
Many organisations still run servers they installed years ago. Each one is a door that needs constant attention — and attackers know which doors get forgotten.
What happened
SentinelOne, Arctic Wolf and Beazley Security described mass exploitation of exposed SharePoint servers and the steps defenders needed to take, including applying Microsoft's updates and rotating machine keys.
What it means for businesses
- Self-hosted means self-defended. You're responsible for patching and monitoring.
- Exposure is the risk. Systems reachable from the internet get scanned within hours of a flaw going public.
- Patching isn't always enough. Sometimes secrets must be rotated and systems checked for intruders.
- Managed services reduce burden for small teams.
What to do now
| Step | Detail |
|---|---|
| Inventory | List every server or app you host that's reachable online |
| Patch fast | Critical updates within days, not months |
| Reduce exposure | Put admin areas behind VPN or access controls |
| Retire legacy | Plan moves to managed, regularly updated services |
The same applies to websites: see our website rescue service for outdated sites.
Frequently asked questions
Was Microsoft 365 affected?
No. Microsoft said SharePoint Online in Microsoft 365 was not affected; the issue concerned on-premises SharePoint Server.
Do small businesses run on-premises servers?
Some do — file servers, old intranets, self-hosted apps. Each needs patching and protection.
Is a WordPress website "on-premises"?
If you manage the hosting and updates, you carry similar responsibilities. Managed care plans reduce that burden.
Patched, monitored, backed up.
We keep your website and web apps updated and monitored so new vulnerabilities don't become your emergency.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply