Critical Microsoft SharePoint flaw now exploited in attacks