SharePoint zero-day lessons: recovery beyond patching
Use the CVE-2025-53770 incident to connect containment, updates, key rotation and investigation.
Contents of this article
A dated incident review
Microsoft’s July 22, 2025 guidance covers exploitation of on-premises SharePoint vulnerabilities including CVE-2025-53770 and CVE-2025-53771. The former entered KEV on July 20. This reviews that incident, not a newly discovered October 2026 flaw.
Scope by deployment model
Distinguish SharePoint Server from SharePoint Online and inventory versions and nodes. Assess retirement or migration for unsupported instances. When restricting public access, retain authorized management and check alternate hostnames and routes.
Remediation and incident recovery both matter
Microsoft’s guidance includes updates, compromise investigation and relevant key rotation. Apply the prescribed sequence across nodes. Suspicious files or account activity require evidence preservation and a broader identity and system investigation.
Prepare for the next disclosure
Maintain owners, isolation procedures, trusted backups and regression checks. Use vendor mitigations while fixes evolve without promising universal protection from a generic rule. Record blocked traffic and affected dependencies to improve the next response.