Hackers Exploit SharePoint 0-Day Vulnerability to Breach US Nuclear Weapons Data

A damaging cyber-intrusion has exposed sensitive data within networks that manage elements of the United States’ nuclear weapons enterprise.

Investigators say a previously unknown SharePoint 0-day exploit granted adversaries privileged access to document repositories that house maintenance schedules, engineering drawings, and parts-tracking records for several strategic weapons systems.

Federal cybersecurity teams are racing to contain impacts while the Department of Defense (DoD) weighs long-term remediation steps.

Forensic analysts trace the breach to a deserialization flaw in Microsoft SharePoint’s workflow engine that enables remote code execution under the context of the SharePoint application pool account.

The vulnerability—undetected by antivirus, EDR, and traditional signature-based scanners—allowed the attackers to upload a rogue DLL, pivot laterally, and establish command-and-control channels through encrypted HTTPS traffic disguised as routine synchronization activity.

Initial exploitation appears to have begun in early April, but visibility gaps meant incident responders did not observe anomalous file integrity events until mid-June.

By then, evidence suggests the threat actors had performed extensive reconnaissance, created hidden admin accounts, and exported multiple gigabytes of unclassified yet sensitive documents marked “For Official Use Only”.

While higher-level classified networks remain segmented, experts caution that metadata gleaned from the compromised enclave could still accelerate adversarial weapons-development timelines.

SharePoint 0-Day Vulnerability

CISA, NSA, and U.S. Cyber Command issued an emergency directive requiring all federal agencies to isolate on-premises SharePoint servers from external access, apply newly released Microsoft out-of-band patches, and deploy YARA rules designed to flag the malicious payload’s unique packing signature.

The Nuclear Security Enterprise’s eight contractor-operated sites have likewise shifted to restrictive firewall policies and are mandating password resets for every privileged user account created since March.

Early containment steps brought down several internal collaboration portals, forcing engineers to revert to air-gapped documentation repositories and slowing scheduled life-extension programs at both Los Alamos and Pantex.

Contractors report that interruptions did not delay current deterrent readiness levels, yet the DoD is conducting a detailed risk assessment to verify no design-integrity compromises occurred.

As incident responders scrub logs and rotate credentials, defense officials reiterate that no warhead safety or command-and-control data were exposed.

Officials also emphasize that launch-control systems remain wholly separated from corporate networks and were never at risk.

Long-Term Implications

The incident underscores lingering weaknesses in defense-industrial supply-chain security, particularly around legacy content-management platforms that remain essential to daily engineering workflows.

According to Report, Experts are calling for accelerated migration to zero-trust architectures, universal multi-factor authentication, and real-time behavioral analytics tuned for operational-technology contexts.

Congressional committees have already scheduled classified briefings to examine whether budgetary constraints delayed previously planned SharePoint decommissioning projects.

Lawmakers are expected to press the DoD on timeline commitments for replacing end-of-life collaboration suites with FedRAMP High-authorized cloud services that offer immutable logging and automated patch orchestration.

Beyond technical fixes, the breach reignites debate over how best to balance efficiency against the unique confidentiality requirements of nuclear stewardship.

Some analysts advocate returning to strictly air-gapped documentation models despite higher operational costs, while others argue that modernized cloud environments—if properly segmented—can reduce human error and improve auditability.

Nevertheless, the event provides adversaries with valuable insight into sustainment workflows, and it is likely to shape forthcoming Nuclear Posture Review cybersecurity annexes.

In the meantime, the newly disclosed 0-day joins SolarWinds and Log4Shell on the growing list of high-impact exploits that have penetrated the federal enclave, reinforcing the urgency of continuous monitoring and rapid patch management across all tiers of the national security ecosystem.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.