Attackers are using a remote execution code on vulnerable systems to initiate a zero-day exploit called "ToolShell" that is affecting certain SharePoint servers and may allow access to Teams, OneDrive or other folders.

The zero-day vulnerability — which was first disclosed late Saturday — has been exploited by several Chinese state-aligned groups, according to Microsoft.