CVE-2025-49706

Analyzed

Published: 08 Jul 2025, 17:15

Last modified:30 Jul 2025, 01:00

Vulnerability Summary

Overall Risk

High Risk

70/100

CVSS Score

6.5 MEDIUM

v3.1

EPSS Score

22.02% HIGH

95%ile 0.00%

CISA KEV

Active

Ransomware

Known Use

Exploits

1 found

Dark Web

Not detected

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Source Identifier: secure@microsoft.com

CVSS	Source	Severity	Exploitability	Impact	Vector
v4.0	n/a
v3.1	Primary secure@microsoft.com	6.5 MEDIUM	3.9	2.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L...
v3.0	n/a
v2.0	n/a

22.02%

Current Score

0.00%

95%ile

Percentile Rank

0.00%

Loading chart...

Improper Authentication CWE-287

Description:When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Vulnerability Name:Microsoft SharePoint Improper Authentication Vulnerability

Added to CISA Catalog:22 Jul 2025, 00:00

Action Due:23 Jul 2025, 00:00

Known Ransomware: Ransomware

Required Action:Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

No dark web activity detected for this vulnerability.

metasploit

Windows

exploitVerified

Authors: Viettel Cyber Security, sfewer-r7

Published: 08 Jul 2025, 00:00

Updated: 06 Aug 2025, 15:33

This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704, and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path. As this exploit module does not target the endpoint associated with CVE-2025-53770 (per the original finders), we believe this module is best described as exploiting CVE-2025-49704 and not CVE-2025-53770.

CVE-2025-49704CVE-2025-49706CVE-2025-53770CVE-2025-53771blog.viettelcybersecurity.com/sharepoint-toolshell/blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/securelist.com/toolshell-explained/zerodayinitiative.com/advisories/ZDI-25-580/zerodayinitiative.com/advisories/ZDI-25-581/msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

Affected Configurations (CPE)

microsoft sharepoint_enterprise_serverVulnerable

Version: 2016

cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*

microsoft sharepoint_serverVulnerable

Version: *

cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*

microsoft sharepoint_serverVulnerable

Version: 2019

cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

URL	Tags	Source
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706	vendor advisory	secure@microsoft.com
https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/	press/media coveragevendor advisory	134c704f-9b21-4f2e-91b3-4a467353bcc0