CISA Issues Alert on Actively Exploited Microsoft SharePoint 0-Day RCE

The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent security alert on July 20, 2025, concerning a critical deserialization vulnerability in Microsoft SharePoint Server on-premises installations.

This CWE-502 classified flaw enables unauthorized attackers to execute arbitrary code remotely over network connections, prompting federal agencies to implement immediate protective measures with a compliance deadline of July 21, 2025.

Technical Details of the Vulnerability

The newly identified vulnerability stems from SharePoint Server’s improper handling of untrusted data during deserialization processes.

Deserialization of untrusted data represents a critical security weakness where applications convert serialized data back into objects without adequate validation, potentially allowing malicious code injection.

This particular flaw, catalogued under Common Weakness Enumeration (CWE-502), affects on-premises SharePoint Server installations and creates a pathway for Remote Code Execution (RCE) attacks.

Attackers exploiting this vulnerability can potentially gain unauthorized system access, manipulate sensitive data, or establish persistent footholds within corporate networks.

The vulnerability’s network-based attack vector eliminates the need for local system access, significantly expanding the potential threat surface for organizations running affected SharePoint instances.

Currently, security researchers have not confirmed whether this vulnerability has been incorporated into active ransomware campaigns, though the severity and ease of exploitation suggest it may become attractive to threat actors seeking initial access vectors.

CISA’s Emergency Response and Recommendations

CISA’s immediate response centers on deploying Antimalware Scan Interface (AMSI) integration across SharePoint environments.

AMSI provides real-time malware detection capabilities by enabling security products to scan scripts and dynamic content before execution, potentially blocking exploitation attempts targeting the deserialization vulnerability.

Additionally, federal agencies must deploy Microsoft Defender Antivirus on all SharePoint servers to provide comprehensive endpoint protection.

This dual-layered approach combines prevention through AMSI with detection and response capabilities through Defender AV.

For organizations unable to implement AMSI integration immediately, CISA mandates disconnecting public-facing SharePoint servers from internet access until official vendor mitigations become available.

This temporary isolation prevents external attackers from exploiting the vulnerability while preserving internal functionality for critical business operations.

Timeline and Industry Impact

The compressed timeline—with vulnerability disclosure on July 20 and mandatory compliance by July 21—underscores the critical nature of this security flaw.

Organizations must follow BOD 22-01 guidance for cloud services or discontinue product usage if adequate mitigations remain unavailable.

This emergency directive affects thousands of organizations running on-premises SharePoint installations, particularly those in critical infrastructure sectors.

The tight remediation window reflects growing concerns about sophisticated threat actors rapidly weaponizing newly disclosed vulnerabilities before organizations can implement protective measures.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates