Critical SharePoint vulnerabilities: Patch now or risk ransomware

⸻ Beyond Energy

Senior Cloud Engineer Graeme Stirling assesses critical on-premises SharePoint vulnerabilities and how to mitigate them.

Microsoft has released urgent security guidance following active exploitation of two critical vulnerabilities in on-premises SharePoint servers:

CVE-2025-49706 – an authentication bypass
CVE-2025-49704 – a remote code execution flaw

These vulnerabilities do not affect SharePoint Online, but organisations running SharePoint Server 2016, 2019, or Subscription Edition are strongly advised to patch immediately.

What’s happening?

Multiple threat actors – including Chinese state-linked groups Linen Typhoon, Violet Typhoon, and Storm-2603 – are exploiting these vulnerabilities in the wild. Storm-2603 has gone further, using them to deploy Warlock ransomware.

The attackers are leveraging a POST request to the ToolPane endpoint to drop a malicious web shell (typically spinstall0.aspx), then using it to steal MachineKey data, escalate privileges, move laterally via WMI and PsExec, and ultimately encrypt systems with ransomware.

Microsoft’s updated guidance includes:

Install latest SharePoint security updates for your version (2016/2019/SE)
Enable Antimalware Scan Interface (AMSI) and Defender Antivirus in Full Mode
Restart IIS and rotate ASP.NET machine keys
Deploy Defender for Endpoint or equivalent EDR/XDR tools
Hunt for indicators of compromise, including specific web shell filenames and C2 domains

Why this matters

Even patched systems are at risk until keys are rotated and services are restarted. Without this, attackers can continue to use stolen credentials or tokens.

Microsoft warns that additional threat actors are likely to adopt these exploits quickly. If you’re still running unpatched on-premise infrastructure – especially internet-facing – this is a high-risk scenario.

Act now

This is a textbook example of how lagging patch cycles and unmonitored infrastructure create perfect conditions for ransomware. It also underscores why cloud migration, proactive vulnerability management, and agent-based monitoring are foundational for secure operations in regulated sectors like energy.

Read Microsoft’s full Microsoft Security Response Center blog post and Threat Intelligence blog for a detailed breakdown of the situation. If you’re unsure whether your SharePoint servers are protected or need support assessing exposure, rotating keys, or hardening your environment, speak to Hypercube’s infrastructure experts. We support secure cloud migration, agent-based detection, and continuous compliance for the energy sector.