Get the latest tech news
Microsoft fixes two SharePoint zero-days under attack, but it's not over - how to patch
The patches fix the security holes in more recent versions of SharePoint, but the 2016 version is still at risk.
"On the evening of July 18, 2025, Eye Security was the first in identifying large-scale exploitation of a newSharePoint remote code execution (RCE)vulnerability chain in the wild," the firm said. Bypassing security protections, hackers can execute code remotely, thereby gaining access to SharePoint content, system files, and configurations. Since SharePoint connects to other Microsoft services such as Outlook, Teams, and OneDrive, hackers can move laterally across a network to steal associated passwords and data.
Or read this on ZDNet