What’s Vulnerable › Vulnerabilities

CVE-2025-49706: Microsoft SharePoint Server Spoofing Vulnerability

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-07-22
• EPSS: 99.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-08 · updated 2026-08-04
• Weakness: CWE-287

Description

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Summary

CVE-2025-49706 is an improper authentication flaw in Microsoft SharePoint Server that lets an unauthenticated attacker perform spoofing over the network; rated CVSS 6.5 (medium). It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit or detection template exists, and EPSS estimates a 99.1% probability of exploitation in 30 days. Affected is Microsoft SharePoint Server, with a fix in version 16.0.18526.20424. Disconnect public-facing SharePoint Server 2013 and earlier (EOL/EOS) instances, apply the fixed build or vendor mitigations to supported versions per CISA and vendor guidance, and follow BOD 22-01 or discontinue use if mitigations are unavailable.

CVE-2025-49706 ثغرة مصادقة غير صحيحة في Microsoft SharePoint Server تتيح لمهاجم غير مصرح له بتنفيذ انتحال عبر الشبكة، بتقييم CVSS 6.5 (متوسط). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويوجد استغلال عام أو قالب كشف، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 99.1%. المنتج المتأثر هو Microsoft SharePoint Server، والإصلاح متوفر في الإصدار 16.0.18526.20424. يجب فصل نسخ SharePoint Server 2013 والإصدارات الأقدم المنتهية الدعم والموجّهة للإنترنت، وتطبيق الإصدار المُصلح أو تخفيفات الجهة المصنّعة على الإصدارات المدعومة وفق إرشادات CISA والمورّد، والالتزام بتوجيه BOD 22-01 أو إيقاف استخدام المنتج إن لم تتوفر التخفيفات.

Affected products

• Microsoft SharePoint Server: 2016
• Microsoft SharePoint Server: before 16.0.18526.20424; 2019 — fixed in 16.0.18526.20424
• Microsoft SharePoint Server Subscription Edition: from 16.0.0 before 16.0.18526.20424 — fixed in 16.0.18526.20424
• Microsoft Sharepoint Enterprise Server 2016: from 16.0.0 before 16.0.5508.1000 — fixed in 16.0.5508.1000
• Microsoft SharePoint Server: from 16.0.0 before 16.0.10417.20027 — fixed in 16.0.10417.20027

How to fix

Upgrade to a fixed version: Microsoft SharePoint Server 16.0.18526.20424; Microsoft SharePoint Server Subscription Edition 16.0.18526.20424; Microsoft Sharepoint Enterprise Server 2016 16.0.5508.1000; Microsoft SharePoint Server 16.0.10417.20027. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706
• https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

Get alerted when CVE-2025-49706 or the next vulnerability affects your stack