Thanks to a scan conducted by @leakix, we have shared SharePoint IPs confirmed vulnerable to CVE-2025-53770, CVE-2025-53771.

424 SharePoint IPs found on 2025-07-23. One-off data in our Vulnerable HTTP report - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/

Tree map overview: https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=other_value&day=2025-07-23&source=exchange&source=exchange6&source=http_vulnerable&source=http_vulnerable6&tag=leakix-vulnerable-sharepoint%2B&data_set=count&scale=log&auto_update=on

Data tagged ‘leakix-vulnerable-sharepoint’.

More information & guidance on the SharePoint incidents:

- https://research.eye.security/sharepoint-under-siege/

- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/