What’s Vulnerable › Vulnerabilities

CVE-2025-49704: Microsoft SharePoint Remote Code Execution Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-07-22
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-08 · updated 2026-06-17
• Weakness: CWE-94

Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Summary

CVE-2025-49704 is a high-severity (CVSS 8.8) code injection flaw in Microsoft SharePoint that lets an authorized attacker execute code over a network. It affects Microsoft SharePoint Enterprise Server 2016 (fixed in 16.0.5508.1000) and Microsoft SharePoint Server (fixed in 16.0.10417.20027). The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS gives a 100.0% probability of exploitation in 30 days. Apply the fixed builds or vendor mitigations for supported versions, and disconnect public-facing SharePoint Server 2013 and earlier EOL/EOS systems.

CVE-2025-49704 ثغرة حقن تعليمات برمجية عالية الخطورة (CVSS 8.8) في Microsoft SharePoint تتيح لمهاجم مصرح له تنفيذ تعليمات برمجية عبر الشبكة. تؤثر الثغرة في Microsoft SharePoint Enterprise Server 2016 (تم إصلاحها في 16.0.5508.1000) وMicrosoft SharePoint Server (تم إصلاحها في 16.0.10417.20027). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط، ويقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 100.0%. طبّق الإصدارات المُصلحة أو تخفيفات المورّد للإصدارات المدعومة، وافصل أنظمة SharePoint Server 2013 والإصدارات الأقدم التي انتهى دعمها عن الإنترنت.

Affected products

• Microsoft SharePoint Server: 2016, 2019
• Microsoft Sharepoint Enterprise Server 2016: from 16.0.0 before 16.0.5508.1000 — fixed in 16.0.5508.1000
• Microsoft SharePoint Server: from 16.0.0 before 16.0.10417.20027 — fixed in 16.0.10417.20027

How to fix

Upgrade to a fixed version: Microsoft Sharepoint Enterprise Server 2016 16.0.5508.1000; Microsoft SharePoint Server 16.0.10417.20027. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704
• https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

Get alerted when CVE-2025-49704 or the next vulnerability affects your stack