A security patch Microsoft released this month failed to fully fix a critical flaw in the U.S. tech giant's SharePoint server software, opening the door to a sweeping global cyber espionage effort, a timeline reviewed by Reuters shows.

Microsoft has pointed the finger at three Chinese nation-state actors for exploiting the SharePoint vulnerabilities. Here's what we know about the security flaws and how to guard against future attacks.

CVE-2025-49696 is particularly worrisome, since it can be exploited via the Preview Pane in Office, meaning no serious user action is required. It allows the combination of an out-of-bounds read and heap-based buffer overflow for an attack that requires no authentication to carry off.