All vulnerabilities
CVE-2025-49706

Microsoft SharePoint Improper Authentication Vulnerability

Microsoft SharePointApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationExploited in the wildAdded to KEV 22 Jul 2025. Known ransomware useCISA KEV
Exploit odds (EPSS)99.1%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16.0.5508.1000Also 16.0.10417.20027, 16.0.18526.20424CVE List
Federal deadline23 Jul 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. CISA KEV

What fixes it

  • 16.0.5508.1000Microsoft SharePoint Enterprise Server 2016CVE List
  • 16.0.10417.20027Microsoft SharePoint Server 2019CVE List
  • 16.0.18526.20424Microsoft SharePoint Server Subscription EditionCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 8 Jul 2025Exploit code publicMetasploit
  2. 8 Jul 2025, 16:58 UTCPublishedCVE List
  3. 22 Jul 2025Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Exploit moduleMicrosoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) 8 Jul 2025Metasploit
  • Scanner templateMicrosoft SharePoint Server - Authentication BypassNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.

Text from CVE List

Affected versions 3

  • Microsoft SharePoint Enterprise Server 2016affected: 16.0.0 before 16.0.5508.1000CVE List
  • Microsoft SharePoint Server 2019affected: 16.0.0 before 16.0.10417.20027CVE List
  • Microsoft SharePoint Server Subscription Editionaffected: 16.0.0 before 16.0.18526.20424CVE List

References 4