6.5

CVE-2025-49706: Microsoft SharePoint Improper Authentication Vulnerability

CVSS: 6.5v3.1MediumKEVRansomwareAnalyzed
Published 08-07-2025Last modified 04-08-2026
Open JSON

Vulnerability summary

CVE-2025-49706 is a medium (CVSS 6.5) Improper Authentication vulnerability in Microsoft SharePoint. It is known to be exploited: CISA lists it, first on 22-07-2025. It has been used in ransomware campaigns. EPSS estimates a 99.09% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
99.09%
0%100%
Critical · +0.03 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits1metasploit

Timeline

  1. 08-07-2025
    PublishedVulnerability first disclosed.
  2. 22-07-2025
    Added to CISA KEVMicrosoft SharePoint Improper Authentication Vulnerability
  3. 23-07-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 04-08-2026
    Last modifiedVulnerability information updated.

Description

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

99.09%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.03 pp

From 99.06% on 19-09-2026

19-09-202619-10-2026
EPSS score
99.09%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
22-07-2025
Federal due date
23-07-2025
Ransomware

CISA required action

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. www.microsoft.com/en-us/… msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706 nvd.nist.gov/vuln/detail/CVE-2025-49706

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)

    exploit/windows/http/sharepoint_toolpane_rce

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Microsoft5 products

1 vendor · 5 products

References

3 links