CVE-2025-49706

Published Jul 8, 2025

Last updated a month ago

Microsoft Office SharePoint

ToolShell

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-49706 is a vulnerability affecting Microsoft Office SharePoint. It stems from improper authentication within the software. This vulnerability could allow an authorized attacker to perform spoofing attacks over a network, potentially compromising the integrity of SharePoint services. Microsoft has released a security update (KB5002751) to address this vulnerability.

Description: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: sharepoint_enterprise_server, sharepoint_server

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 2.5
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Microsoft SharePoint Improper Authentication Vulnerability
Exploit added on: Jul 22, 2025
Exploit action due: Jul 23, 2025
Required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Weaknesses

secure@microsoft.com: CWE-287

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9C082CC4-6128-475D-BC19-B239E348FDB2"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B006E0D5-DEDF-490A-9BC6-D2DC34DF98B2",
            "versionEndExcluding": "16.0.18526.20424"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6122D014-5BF1-4AF4-8B4D-80205ED7785E"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.