Active Attacks Targeting On-premises SharePoint Server

Network IOCs:

• 107.191.58[.]76
• 104.238.159[.]149
• 96.9.125[.]147

Vulnerabilities:

• CVE-2025-53770 (new, no patch as of 2025-07-20)
• CVE-2025-49704 (2025-07 patch)
• CVE-2025-49706 (2025-07 patch)

Also see

• research.eye.security/sharepoint-under-siege/
• github.com/…/2025-07-19-Microsoft-SharePoint-vuln…
• msrc.microsoft.com/…/customer-guidance-for-sharep…
• x.com/msftsecresponse/status/1946737930849939793