A Microsoft SharePoint vulnerability is being actively exploited by bad actors to gain administrative control over Microsoft-powered devices.
In a public statement in Wednesday, the US Cybersecurity and Infrastructure Security Agency added the exploit to its exploited vulnerabilities catalog that hackers frequently use.
The vulnerability (CVE-2023-29357) allows cyberattacks to gain fake authentication tokens to bypass security networks and "gain access to the privileges of an authenticated user."
It is unknown how many devices have already been affected by the exploit. No names for the groups responsible for the attacks were given.
How to Protect PCs from Microsoft SharePoint Vulnerability
For those using the app, Microsoft has already released a patch for the SharePoint vulnerability in June last year.
Installing the patch will permanently fix the vulnerability and protect the device from similar attacks in the future.
The CVE-2023-29357 patch is available for Windows 10 and 11 devices.
The security vulnerability is labeled as "critical" and users are recommended to update their devices as soon as possible.
Related Article : Microsoft May Soon Charge Windows 10 Users for Security Updates
More Vulnerabilities are Being Exploited Now
Cyberattacks have been on the rise since 2023 as more advanced methods are being used to bypass modern security networks.
According to a study from the Massachusetts Institute of Technology, more ransomware attacks have been recorded in the first nine months of 2023 than in the entirety of 2022.
Last year also recorded several critical cyberattacks on relevant sectors of society, including healthcare and national services.
Devices running on older operating systems are more vulnerable to cyberattacks, primarily ransomware attacks, as the system does not receive regular security support from software providers.
Vulnerable hardware components from older devices are also at risk of attacks.
It is recommended to regularly update devices to newer releases to reduce the risk of falling victim to active zero-day exploits.
