CVE-2025-49701
Published: 08 July 2025
Summary
CVE-2025-49701 is a high-severity Improper Authorization (CWE-285) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-49701 is an improper authorization vulnerability, tracked under CWE-285, that affects Microsoft Office SharePoint. The flaw carries a CVSS 3.1 base score of 8.8 and permits an attacker to execute arbitrary code over a network when the affected component is reached with valid credentials.
An authorized attacker with low attack complexity and no user interaction required can leverage the weakness to obtain full confidentiality, integrity, and availability impact on the targeted SharePoint deployment. Exploitation occurs remotely across the network and does not require elevated privileges beyond those already granted to the account.
Microsoft has published an advisory for CVE-2025-49701 that directs administrators to the corresponding security update. The current EPSS score of 0.0132, with a recorded peak of 0.0182, remains low and shows no material increase that would indicate emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20557
Vulnerability details
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authorization in public-facing SharePoint server directly enables remote arbitrary code execution by an authenticated attacker.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to system resources, directly mitigating the improper authorization flaw that allows low-privileged users to execute code in SharePoint.
AC-24 ensures access control decisions are based on valid policies, addressing the flawed authorization mechanisms enabling remote code execution.
AC-6 applies least privilege to restrict low-privileged authenticated users from performing actions that lead to arbitrary code execution.