SharePoint Vulnerability 07/2025

Important to know

• These vulnerabilities apply only for on-premises SharePoint Servers. SharePoint Online in Microsoft 365 is unaffected.
• The updates are  cumulative: you don't need to install previous updates separately if you apply the latest one.
• Microsoft has also published detection and hunting queries for use in Microsoft Defender

It is crucial that organisations using SharePoint Server 2016, 2019 or the Subscription Edition, immediately apply the latest security updates.

✅ What to do?

• Update to a supported version of SharePoint Server (2016, 2019 or Subscription Edition).
• Install the July 2025 security updates
• Activate AMSI (Antimalware Scan Interface) and ensure correct configuration with an antivirus solution such as Microsoft Defender Antivirus.
• Run the ASP.NET machine keys again and restart IIS on all SharePoint servers.
• Deploy Microsoft Defender for Endpoint or an equivalent solution for detection of post-exploit activities.