{"schemaVersion":3,"id":"CVE-2025-49704","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft SharePoint Code Injection Vulnerability","description":"Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","dates":{"published":"2025-07-08T16:58:05.908Z","modified":"2026-02-13T19:07:40.974Z","reserved":null,"kevAdded":["2025-07-22T00:00:00.000Z"],"kevDue":["2025-07-23T00:00:00.000Z"]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99995,"percentile":0.99988,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.99995},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99995,"percentile":0.99988}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99995,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99995,"percentile":0.99988}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-07-22T00:00:00.000Z","dueDate":"2025-07-23T00:00:00.000Z","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","name":"Microsoft SharePoint Code Injection Vulnerability","description":"Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.","notes":[{"type":"text","value":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770"},{"type":"url","href":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","label":"www.microsoft.com/en-us/…"},{"type":"url","href":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-49704","label":"nvd.nist.gov/vuln/detail/CVE-2025-49704"}],"vendor":"Microsoft","product":"SharePoint","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-07-22T00:00:00.000Z","dueDate":"2025-07-23T00:00:00.000Z","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","name":"Microsoft SharePoint Code Injection Vulnerability","description":"Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.","notes":[{"type":"text","value":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770"},{"type":"url","href":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","label":"www.microsoft.com/en-us/…"},{"type":"url","href":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-49704","label":"nvd.nist.gov/vuln/detail/CVE-2025-49704"}],"vendor":"Microsoft","product":"SharePoint","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"MSF_EXPLOIT_WINDOWS_HTTP_SHAREPOINT_TOOLPANE_RCE","name":"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/http/sharepoint_toolpane_rce.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/http/sharepoint_toolpane_rce","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs"],"reliability":["repeatable-session"]}}],"exploitCount":1,"weaknesses":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"}],"affected":[{"vendor":"microsoft","product":"microsoft sharepoint enterprise server 2016","name":"Microsoft SharePoint Enterprise Server 2016","label":"microsoft sharepoint enterprise server 2016","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, < 16.0.5508.1000","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, < 16.0.5508.1000","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_enterprise_server_2016"},{"vendor":"microsoft","product":"microsoft sharepoint server 2019","name":"Microsoft SharePoint Server 2019","label":"microsoft sharepoint server 2019","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, < 16.0.10417.20027","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, < 16.0.10417.20027","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_server_2019"},{"vendor":"microsoft","product":"sharepoint_server","name":"sharepoint server","label":"sharepoint_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016","noFixRecorded":false,"fixedIn":null},{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016 | 2019","eol":null,"hubHref":"/vendor/microsoft/sharepoint_server"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704","hostname":"msrc.microsoft.com","tags":["Vendor Advisory","Patch"]},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","label":"www.microsoft.com/en-us/…","hostname":"www.microsoft.com","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-07-08T16:58:05.908Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2025-07-22T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft SharePoint Code Injection Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2025-07-23T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-02-13T19:07:40.974Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T12:21:01.107Z","stale":false,"partial":false}}