.svg){kind=icon}
Newsletter
Stay up to date with our monthly newsletter.
Covering the latest thought leadership, events, and news about identity security
.svg)
What We Do
Partners
© MajorKey 2026
.svg)
A critical zero-day vulnerability in Microsoft SharePoint Server on-premises deployments was recently disclosed and is currently being actively exploited in the wild. This flaw, now tracked as CVE-2025-30556, allows unauthenticated attackers to execute arbitrary code remotely, potentially leading to full server compromise and lateral movement across an organization’s network.
According to reports from The Hacker News and KrebsOnSecurity, the vulnerability stems from insufficient input validation in SharePoint's web services and can be triggered by specially crafted SOAP requests. Microsoft has confirmed that the flaw impacts SharePoint Server 2016, 2019, and Subscription Edition, particularly in configurations that expose SharePoint to the internet or allow remote service calls internally.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities Catalog and has urged all federal agencies and private sector entities to take immediate action. (CISA Alert)
Microsoft has issued out-of-band security updates and mitigation guidance for impacted SharePoint versions. These updates are designed to patch the vulnerable components and include additional telemetry improvements to detect signs of exploitation.
You can find Microsoft’s official guidance here: MSRC Advisory on CVE-2025-30556
If you're running SharePoint Server on-premises, take the following steps right away:
This is another reminder that perimeter-based security is no longer sufficient. Organizations must implement strong Identity Governance, Role-Based Access Control (RBAC), Privileged Identity Management (PIM), and Privileged Access Management (PAM) for all administrative accounts, including those used by SharePoint.
Even in on-premises environments, consider extending modern identity protection tools (like Microsoft Entra) via hybrid join, Conditional Access, and Defender for Identity and strengthening access governance with PAM tools like Idira by Palo Alto Networks (formerly CyberArk).
Organizations running SharePoint on-premises should treat this vulnerability as critical and act without delay. If your team needs assistance validating patch deployment or reviewing your SharePoint architecture and access policies, MajorKey Technologies can help.
Ask yourself, do you manage your privilege access today? Who certifies them and ensures that there is zero standing privilege?
Contact MajorKey for a rapid review of your SharePoint security posture and guidance on hardening your hybrid infrastructure.
Active Directory Domain Services relies heavily on LDAP, but not every LDAP connection is automatically protected against interception, modification, or authentication-relay attacks.
Learn why modern PAM strategies must extend beyond administrator accounts to include machine identities, cloud entitlements, Just-in-Time access, and Zero Standing Privilege. Dan Ross shares practical guidance for building a scalable privileged access program.
What C-suite leaders need to know about the upcoming Microsoft Entra ID SSPR changes, its operational risks, and how to mitigate them.
Auditors don’t just ask who has access today. Identity governance needs to be reframed as a continuous regulatory defense, not a periodic compliance exercise.
When effective change management is integrated with IGA implementations from the start, organizations reduce resistance, increase alignment, and ensure new identity processes take root in a sustainable, scalable way.
Learn about the challenges created by identity silos, the trade-offs between consolidation and governance, and how organizations can determine the most effective path forward.
Covering the latest thought leadership, events, and news about identity security