All vulnerabilities
CVE-2025-49704

Microsoft SharePoint Code Injection Vulnerability

Microsoft SharePointApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 22 Jul 2025. Known ransomware useCISA KEV
Exploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16.0.5508.1000Also 16.0.10417.20027CVE List
Federal deadline23 Jul 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. CISA KEV

What fixes it

  • 16.0.5508.1000Microsoft SharePoint Enterprise Server 2016CVE List
  • 16.0.10417.20027Microsoft SharePoint Server 2019CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 8 Jul 2025Exploit code publicMetasploit
  2. 8 Jul 2025, 16:58 UTCPublishedCVE List
  3. 22 Jul 2025Added to CISA KEVCISA KEV

Public exploit code and templates 1

  • Exploit moduleMicrosoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) 8 Jul 2025Metasploit

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

Text from CVE List

Affected versions 2

  • Microsoft SharePoint Enterprise Server 2016affected: 16.0.0 before 16.0.5508.1000CVE List
  • Microsoft SharePoint Server 2019affected: 16.0.0 before 16.0.10417.20027CVE List

References 4