A week after Microsoft told the world that its July software updates didn’t fully fix a couple of bugs, which allowed miscreants to take over on-premises SharePoint servers and remotely execute code, researchers have assembled much of the puzzle — with one big missing piece.
How did the attackers, who include Chinese government spies, data thieves, and ransomware operators, know how to exploit the SharePoint CVEs in such a way that would bypass the security fixes Microsoft released the following day?
“A leak happened here somewhere,” Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative (ZDI), told The Register. “And now you’ve got a zero-day exploit in the wild, and worse than that, you’ve got a zero-day exploit in the wild that bypasses the patch, which came out the next day.”
Countdown to mass exploitation
It all began back in May, on stage at the Pwn2Own competition.
Pwn2Own is the hackers’ equivalent of the World Series, and ZDI usually hosts these competitions twice a year.
The most recent contest occurred in Berlin, beginning May 15. On day 2 of the event, Vietnamese researcher Dinh Ho Anh Khoa combined an auth bypass and an insecure deserialization bug to exploit Microsoft SharePoint and win $100,000.
“What happens on the stage is just one part of Pwn2Own,” Childs said.
After demonstrating a successful exploit, the bug hunter and vendor are whisked away into a private room where the researcher explains what they did and provides the technology company with a full write-up of the exploit. Assuming it’s not a duplicate or already known vulnerability, the vendor then has 90 days to issue a fix before the bug and exploit are made public.
“So Microsoft received the working exploit in a white paper describing everything on that day,” Childs said.
Less than two months later, on July 8, the software giant disclosed the two CVEs – CVE-2025-49704, which allows unauthenticated remote code execution, and CVE-2025-49706, a spoofing bug – and released software updates intended to patch the flaws. But mass exploitation had already started the day before, on July 7.
“Sixty days to fix really isn’t a bad timeline for a bug that stays private and stays under coordinated disclosure rules,” Childs said. “What is bad: a leak happened.”
There’s another key date that may shed light on when that leak happened.
Patch Tuesday happens the second Tuesday of every month – in July, that was the 8th. But two weeks before then, Microsoft provides early access to some security vendors via the Microsoft Active Protections Program (MAPP).
These vendors are required to sign a non-disclosure agreement about the soon-to-be-disclosed bugs, and Microsoft gives them early access to the vulnerability information so that they can provide updated protections to customers faster.
“The first MAPP drop occurs at what we call r minus 14, which is two weeks ahead of the [Patch Tuesday] release,” Childs said – that is, beginning on June 24. “Then, on July 7, we started to see attacks. July 8, the patches were out and were almost immediately bypassed.”
ZDI, along with other security providers, poked holes in the initial patches and determined that the authentication bypass piece was too narrow, and attackers could easily bypass this fix. In fact, anyone who received the early MAPP information about the CVEs and software updates “would be able to tell that this is an easy way to get past it,” Childs said.
On July 18, Eye Security first sounded the alarm on “large-scale exploitation of a new SharePoint remote code execution (RCE) vulnerability chain in the wild.”
A day later, Microsoft warned SharePoint server users that three on-prem versions of the product included a zero-day flaw that was under attack – and that its own failure to completely patch the holes was to blame.
By July 21, Redmond had issued software updates for all three versions. But by then, more than 400 organizations had been compromised by at least two Chinese state-sponsored crews, Linen Typhoon and Violet Typhoon, plus a gang Microsoft tracks as Storm-2603, which was abusing the vulnerabilities to deploy ransomware.
Microsoft declined to answer The Register‘s specific questions for this story. “As part of our standard process, we’ll review this incident, find areas to improve, and apply those improvements broadly,” a Microsoft spokesperson said in an emailed statement.
One researcher suggests a leak may not have been the only pathway to exploit. “Soroush Dalili was able to use Google’s Gemini to help reproduce the exploit chain, so it’s possible the threat actors did their own due diligence, or did something similar to Dalili, working with one of the frontier large language models like Google Gemini, o3 from OpenAI, or Claude Opus, or some other LLM, to help identify routes of exploitation,” Tenable Research Special Operations team senior engineer Satnam Narang told The Register.
“It’s difficult to say what domino had to fall in order for these threat actors to be able to leverage these flaws in the wild,” Narang added.
Nonetheless, Microsoft did not release any MAPP guidance for the two most recent vulnerabilities, CVE-2025-53770 and CVE-2025-53771, which are related to the previously disclosed CVE-2025-49704 and CVE-2025-49706.
“It could mean that they no longer consider MAPP to be a trusted resource, so they’re not providing any information whatsoever,” Childs speculated. “It also could mean that they’re scrambling so much to work on the fixes they don’t have time to notify their partners of these other details.”
“It could just be a logistical resource issue, or it could be, hey, I don’t trust MAPP right now, we’re not telling them anything, which is what I would do in their situation,” he continued. “If I thought a leak came from this channel, I would not be telling that channel anything.” ®
Source link
