CVE-2025-49706

Analyzed

Published: 08 Jul 2025, 17:15

Last modified:27 Oct 2025, 17:12

Vulnerability Summary

Overall Risk

Critical Risk

75/100

AI Analysis

Emergency

Requires Immediate Action

AI Detection

Active in Wild

Exploitation Detected

CVSS Score

6.5 MEDIUM

CVSS v3.1 (MICROSOFT)

EPSS Score

47.41% HIGH

47% probability -4.44%

CISA KEV

Listed

Microsoft

Ransomware

Known Use

Exploits

1 found

Dark Web

Activity detected

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Source Identifier: secure@microsoft.com

CVSS	Source	Severity	Exploit.	Impact	Vector
v4.0	n/a
v3.1	Primarysecure@microsoft.com	6.5 MEDIUM	3.9	2.5	CVSS:3.1/AV:N/AC:L/PR:N/U...
v3.0	n/a
v2.0	n/a

44.32%

Current Score

-4.44%

97%ile

Percentile Rank

-0.22%

Loading chart...

Improper Authentication CWE-287

Description:When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Vulnerability Name:Microsoft SharePoint Improper Authentication Vulnerability

Added to CISA Catalog:22 Jul 2025, 00:00

Action Due:23 Jul 2025, 00:00

Known Ransomware: Ransomware

Required Action:Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Telegram Activity Detected

This vulnerability has been mentioned in monitored Telegram channels, indicating potential threat actor interest.

metasploit

Windows

exploitVerified

Authors: Viettel Cyber Security, sfewer-r7

Published: 08 Jul 2025, 00:00

Updated: 06 Aug 2025, 15:33

This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704, and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path. As this exploit module does not target the endpoint associated with CVE-2025-53770 (per the original finders), we believe this module is best described as exploiting CVE-2025-49704 and not CVE-2025-53770.

CVE-2025-49704CVE-2025-49706CVE-2025-53770CVE-2025-53771blog.viettelcybersecurity.com/sharepoint-toolshell/blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/securelist.com/toolshell-explained/zerodayinitiative.com/advisories/ZDI-25-580/zerodayinitiative.com/advisories/ZDI-25-581/msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

Affected Configurations (CPE)

microsoft sharepoint_enterprise_serverVulnerable

Version: 2016

cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*

microsoft sharepoint_serverVulnerable

Version: *

cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*

microsoft sharepoint_serverVulnerable

Version: 2019

cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

URL	Tags	Source
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706	vendor advisory	secure@microsoft.com
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706	-	134c704f-9b21-4f2e-91b3-4a467353bcc0
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706	us government resource	134c704f-9b21-4f2e-91b3-4a467353bcc0
https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/	press/media coveragevendor advisory	134c704f-9b21-4f2e-91b3-4a467353bcc0