CVE-2025-49704: Microsoft SharePoint Code Injection Vulnerability
Vulnerability summary
CVE-2025-49704 is a high (CVSS 8.8) Code Injection vulnerability in Microsoft SharePoint. It is known to be exploited: CISA lists it, first on 22-07-2025. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 08-07-2025PublishedVulnerability first disclosed.
- 22-07-2025Added to CISA KEVMicrosoft SharePoint Code Injection Vulnerability
- 23-07-2025CISA remediation dueApply mitigations per vendor instructions.
- 13-02-2026Last modifiedVulnerability information updated.
Description
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
100.00%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 100.00% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 22-07-2025
- Federal due date
- 23-07-2025
CISA required action
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. www.microsoft.com/en-us/… msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704 nvd.nist.gov/vuln/detail/CVE-2025-49704
Public exploits
1 foundMicrosoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
exploit/windows/http/sharepoint_toolpane_rce
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Microsoft3 products
- microsoft sharepoint enterprise server 2016≥ 16.0.0, < 16.0.5508.1000
- microsoft sharepoint server 2019≥ 16.0.0, < 16.0.10417.20027
- sharepoint_server2016 | 2019
1 vendor · 3 products
References
3 links
- www.microsoft.com/en-us/…Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704Government ResourceUS Government Resource