Unit 42 Threat Briefing | Defending Against Active Microsoft SharePoint Exploits

Palo Alto Networks is hosting a live threat briefing to provide timely guidance on recently disclosed Microsoft SharePoint vulnerabilities currently being exploited in the wild. CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771 impact on-premises SharePoint servers and, when chained, allow unauthenticated attackers to execute arbitrary commands. We’ll share what our IR and Threat Intel teams are seeing in active investigations, outline how these exploits are being used to bypass identity controls and offer practical recommendations for detection, containment and response. The session will include a technical walkthrough, mitigation guidance and time for a live Q&A. In this live threat briefing, we will provide: - An overview of the vulnerabilities and how they’re being combined to enable remote code execution. - A summary of current threat activity targeting on-premises SharePoint environments. - Insight into common attacker behaviors, including persistence techniques and access escalation. - Guidance on how to assess exposure, validate compromise and respond. - Why patching alone may not be sufficient and what additional steps are recommended. - Available resources and support from Palo Alto Networks and Unit 42. Act now to equip your organization against these persistent adversaries.