---
id: "CVE-2025-49704"
kind: "vulnerability"
aliases: ["CVE-2025-49704"]
title: "microsoft sharepoint server: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized\u2026"
severity: "critical"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Microsoft SharePoint", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2016", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2019", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "on-premises", "ransomware", "self-hosted", "sharepoint", "vendor", "windows"]
not_affected_if: ["not-internet-facing", "sharepoint-online"]
published_at: "2025-07-08T17:15:57+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49704", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49704", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# microsoft sharepoint server: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized…

Microsoft SharePoint has a code injection flaw that lets an authorized attacker run code on the server over the network. It is listed as exploited in the wild and tied to ransomware use, and it can be chained with CVE-2025-49706.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft SharePoint affected ? fixed ?
- vendor:microsoft sharepoint server affected = 2016 fixed ?
- vendor:microsoft sharepoint server affected = 2019 fixed ?

## How to check

Check the installed SharePoint Server build against Microsoft's July 2025 security update list for SharePoint Server (unknown exact build numbers in sources).
List SharePoint servers reachable from the internet and confirm each one is patched or disconnected.
Look for unknown IOCs in IIS and SharePoint logs; sources do not give specific indicators.

## Fix

Apply the Microsoft update for CVE-2025-49704 and the follow-on update for CVE-2025-53770, which is the more robust fix (version numbers unknown in sources).
Disconnect end-of-life SharePoint Server versions (2013 and earlier) from the public internet, or stop using them.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49704
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-49704

## From the sources

Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

CISA required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_