Is an on-premises SharePoint server on the internet a risk?

What is on-premises SharePoint?

These vulnerabilities affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016)

SharePoint Server is Microsoft's document and intranet server that a firm runs on its own hardware or rented server, rather than in Microsoft 365.

Why does it matter?

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability 2025-07-20 Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network.

CISA added CVE-2025-53770 to its catalog of exploited flaws on 20 July 2025. CISA says it could let an unauthorized attacker run code over a network.

In its alert last revised 26 August 2026, CISA says newer exploited flaws affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016).

What do I do about it?

Avoid exposing SharePoint Servers directly to the internet. If exposure is unavoidable, require a Layer 7 reverse proxy or equivalent application-layer security control that enforces authentication and inspects and filters all inbound requests.

CISA's first recommendation: avoid exposing SharePoint Servers directly to the internet.

1. Take the server off the open internet, or put an authenticating reverse proxy in front of it.
2. Apply Microsoft's latest SharePoint updates and confirm they installed.
3. Turn on AMSI integration for each SharePoint web application.
4. Block outside access to SharePoint Central Administration.