CVE-2025-49706
Published: 08 July 2025
Summary
CVE-2025-49706 is a medium-severity Improper Authentication (CWE-287) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2025-49706 is an improper authentication vulnerability in Microsoft Office SharePoint that enables an unauthorized attacker to perform spoofing over a network. Published on 2025-07-08, the issue carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and maps to CWE-287.
The vulnerability can be exploited by any unauthorized attacker with network access, requiring low complexity and no user interaction or privileges. Successful exploitation allows spoofing, resulting in low confidentiality and integrity impacts without affecting availability.
Advisories from Microsoft Security Response Center detail patches and mitigations at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706. The vulnerability appears in CISA's Known Exploited Vulnerabilities catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706. Microsoft's security blog addresses disrupting active exploitation of on-premises SharePoint vulnerabilities at https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/.
This vulnerability has seen real-world exploitation, as evidenced by its inclusion in CISA's catalog and Microsoft's report on active attacks against on-premises SharePoint deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20552
Vulnerability details
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CWE(s)
- KEV Date Added
- 22 July 2025
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct network-accessible improper authentication bypass in public-facing SharePoint server enables initial access via exploitation of the exposed web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of identified flaws, including applying Microsoft patches for this specific improper authentication vulnerability in SharePoint to prevent spoofing exploitation.
Mandates robust identification and authentication for organizational users and processes, directly countering the improper authentication mechanism that enables network-based spoofing in SharePoint.
Enforces approved access authorizations in accordance with policy, ensuring spoofed identities from improper authentication are denied logical access to SharePoint resources.