Microsoft’s on-premises SharePoint Server is under active exploitation via a multi-stage attack chain Microsoft has named ToolShell, targeting a critical vulnerability patched in January 2025. Organizations running on-premises SharePoint that have not applied the January 2025 security updates are at immediate risk of compromise. Successful exploitation can give attackers a foothold inside the corporate network, with potential for data exfiltration, lateral movement, and broader infrastructure compromise.