CISA has a pretty plain message for anyone running Microsoft SharePoint: patch it, verify it, and do not pretend a scheduled update is the same thing as a finished update.
That sounds like an IT checklist item. It is not.
For a lot of small businesses, SharePoint is where contracts, files, drafts, internal procedures, and client documents live. If the platform is exposed and unpatched, the problem is not just security theater. It is a business continuity risk.
The agency warned on July 14 that it is seeing active exploitation tied to SharePoint vulnerabilities and told organizations to apply the latest Microsoft patches, confirm the installation completed successfully, and shorten patching cycles when possible. CISA also added four newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalog that same day.
That last part matters because "we usually patch on Fridays" is not a strategy once attackers are actively hitting the same software your business depends on.
The practical move here is simple:
- Ask who owns SharePoint patching in your business or IT stack.
- Confirm the patch was actually installed, not just queued.
- Check whether any internet-facing SharePoint instance is still exposed.
- Review external sharing, guest access, and admin permissions while you are there.
If you are a one-office business, this may sound bigger than it feels. But the reality is that a document system is not "just files" anymore. It is often the center of how work moves. When that system is compromised, everything downstream slows down.
The owner takeaway is blunt: treat patching like payroll and cash flow, not like a nice-to-have maintenance task. If you cannot say with confidence that your SharePoint environment is current, you have a problem that deserves same-day attention.