{"id":"CVE-2025-49704","kind":"vulnerability","aliases":["CVE-2025-49704"],"related":[],"title":"microsoft sharepoint server: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized…","description":"Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.\n\nCISA required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","summary":"Microsoft SharePoint has a code injection flaw that lets an authorized attacker run code on the server over the network. It is listed as exploited in the wild and tied to ransomware use, and it can be chained with CVE-2025-49706.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2025-07-22T00:00:00+00:00","products":[{"name":"Microsoft SharePoint","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":[],"affected":"= 2016","ecosystem":"vendor"},{"name":"microsoft sharepoint server","fixed":[],"affected":"= 2019","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","on-premises","ransomware","self-hosted","sharepoint","vendor","windows"],"not_affected_if":["not-internet-facing","sharepoint-online"],"how_to_check":"Check the installed SharePoint Server build against Microsoft's July 2025 security update list for SharePoint Server (unknown exact build numbers in sources).\nList SharePoint servers reachable from the internet and confirm each one is patched or disconnected.\nLook for unknown IOCs in IIS and SharePoint logs; sources do not give specific indicators.","fix":"Apply the Microsoft update for CVE-2025-49704 and the follow-on update for CVE-2025-53770, which is the more robust fix (version numbers unknown in sources).\nDisconnect end-of-life SharePoint Server versions (2013 and earlier) from the public internet, or stop using them.","status":"open","published_at":"2025-07-08T17:15:57+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:41+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:46:41Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2025-49704 and the follow-on update for CVE-2025-53770, which is the more robust fix (version numbers unknown in sources).\nDisconnect end-of-life SharePoint Server versions (2013 and earlier) from the public internet, or stop using them.","reach":"network","summary":"Microsoft SharePoint has a code injection flaw that lets an authorized attacker run code on the server over the network. It is listed as exploited in the wild and tied to ransomware use, and it can be chained with CVE-2025-49706.","category":"vendor","who_cares":["sharepoint","self-hosted","windows","on-premises"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs code on the SharePoint server and can reach its stored data and secrets.","analyst_note":"Find the exact patched build numbers and IOC guidance in the Microsoft advisory for CVE-2025-49704 and CVE-2025-53770 and the CISA mitigation page linked from the KEV entry.","how_to_check":"Check the installed SharePoint Server build against Microsoft's July 2025 security update list for SharePoint Server (unknown exact build numbers in sources).\nList SharePoint servers reachable from the internet and confirm each one is patched or disconnected.\nLook for unknown IOCs in IIS and SharePoint logs; sources do not give specific indicators.","needs_analyst":true,"not_affected_if":["sharepoint-online","not-internet-facing"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000551,"input_tokens":2707,"output_tokens":561,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':205C '-2025':20A,23A,84B,112C,115C,123C,130C,140C '-49704':21A,24A,124C,141C '-49706':85B,113C '-53770':116C,131C '2013':172C '22':204C 'accord':183C 'action':144C 'adher':199C 'allow':16A,95C 'applic':202C 'attack':55B,98C 'author':18A,54B,97C 'avail':220C 'bod':203C 'bypass':120C 'chain':81B,109C 'cisa':142C,185C 'cloud':208C 'code':9A,10A,48B,57B,90C,101C 'contain':88C 'control':5A 'could':94C,107C 'cve':19A,22A,83B,111C,114C,122C,129C,139C 'disconnect':145C 'discontinu':211C 'earlier':174C 'end':158C,164C 'end-of-lif':157C 'end-of-servic':163C 'eo':167C 'eol':161C 'execut':100C 'exploit':33B,68B 'face':148C 'flaw':50B 'follow':180C 'generat':7A 'guidanc':206C 'host':40B 'improp':4A 'includ':132C,169C 'inject':11A,49B,91C 'instruct':193C 'let':52B 'life':160C 'list':66B,187C,195C 'microsoft':1A,13A,25A,27A,30A,44B,86C 'mitig':182C,217C 'network':63B,104C 'note':190C,198C 'offic':14A 'on-premis':34B 'patch':119C 'pleas':179C 'premis':36B 'product':215C 'protect':135C 'public':147C 'public-fac':146C 'ransomwar':37B,75B 'reach':155C 'requir':143C 'robust':134C 'run':56B 'self':39B 'self-host':38B 'server':3A,29A,32A,60B,152C,171C 'servic':166C,209C 'sharepoint':2A,15A,26A,28A,31A,41B,45B,87C,151C,170C 'support':177C 'tie':73B 'updat':127C 'url':186C,194C 'use':76B,212C 'vendor':42B,192C 'version':149C,175C,178C 'vulner':92C,106C 'wild':71B 'window':43B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-07-08T17:15:57+00:00","kev":{"dateAdded":"2025-07-22","dueDate":"2025-07-23","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-49704","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49704","severity":null,"published_at":"2025-07-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-49704","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49704","severity":null,"published_at":"2025-07-08T17:15:57+00:00","modified_at":"2026-06-17T09:31:46+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}