Cyber Posture

CVE-2025-49704

HighCISA KEVActive ExploitationRansomware-linkedRCE

Published: 08 July 2025

Published
08 July 2025
Modified
27 October 2025
KEV Added
22 July 2025
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.5958 98.3th percentile
Risk Priority 73 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-49704 is a high-severity Code Injection (CWE-94) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely flaw remediation through application of Microsoft patches directly eliminates the code injection vulnerability in SharePoint.

prevent

Information input validation prevents code injection by ensuring user-supplied inputs to SharePoint do not contain executable code.

detect

Vulnerability scanning detects the presence of CVE-2025-49704 in SharePoint deployments, enabling prioritization for patching.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Code injection (CWE-94) leading to unauthenticated RCE on SharePoint directly enables remote exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Deeper analysisAI

CVE-2025-49704 is an improper control of code generation vulnerability, classified as code injection (CWE-94), affecting Microsoft Office SharePoint. Published on 2025-07-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with low complexity and privileges.

An authorized attacker with low privileges, such as an authenticated SharePoint user, can exploit this vulnerability over the network without requiring user interaction. Successful exploitation allows arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability on the targeted system.

Microsoft's update guide provides patches for remediation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704. The vulnerability appears in CISA's Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704. A Microsoft security blog post addresses disrupting active exploitation of on-premises SharePoint vulnerabilities: https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/.

This vulnerability is actively exploited in the wild, particularly against on-premises SharePoint deployments, underscoring the urgency of applying available patches.

Details

CWE(s)
KEV Date Added
22 July 2025

Affected Products

microsoft
sharepoint server
2016, 2019

CVEs Like This One

CVE-2025-53770Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2026-20963Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2026-32201Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2025-49706Same product: Microsoft Sharepoint Serverboth on KEV
CVE-2026-26106Same product: Microsoft Sharepoint Server
CVE-2025-54897Same product: Microsoft Sharepoint Server
CVE-2025-49712Same product: Microsoft Sharepoint Server
CVE-2025-49701Same product: Microsoft Sharepoint Server
CVE-2025-59228Same product: Microsoft Sharepoint Server
CVE-2025-21348Same product: Microsoft Sharepoint Server

References