Critical SharePoint Zero-Day Exploited in 75+ Organizations

A critical zero-day vulnerability in Microsoft SharePoint Server, CVE-2025-53770, is actively being exploited in large-scale attacks, breaching over 75 organizations worldwide. Microsoft is working on a fix, but until then, recommended mitigations include enabling AMSI integration and deploying Defender AV. The attack chain involves delivering ASPX payloads via PowerShell to steal server keys, enabling remote code execution and persistent access.