CVE-2025-49704
Microsoft SharePoint Code Injection Vulnerability
Description
CVE-2025-49704 is a high-severity code injection vulnerability in Microsoft SharePoint Server that allows an authorized attacker to execute arbitrary code over the network. Classified under CWE-94 (Code Injection), this vulnerability affects SharePoint Server 2016 and 2019, enabling an authenticated user with low-level privileges to inject and execute malicious code within the SharePoint server context. With a CVSS v3.1 base score of 8.8 (High), the vulnerability is particularly dangerous because CISA has confirmed its use in ransomware campaigns and has issued an aggressive remediation deadline of July 23, 2025 — just one day after the KEV listing. The EPSS score of 66.47% at the 98th percentile confirms that this is one of the most actively exploited vulnerabilities in the current threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704(US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/(Vendor Advisory)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2025-49704 is classified under CWE-94, which occurs when software constructs code segments using externally-influenced input without properly neutralizing special elements that could modify the intended code syntax or behavior. In Microsoft SharePoint Server, the vulnerability allows an authenticated attacker to inject code that is then executed by the server, enabling arbitrary command execution within the SharePoint application context. This class of vulnerability is especially dangerous in enterprise collaboration platforms where the injected code can access sensitive documents, user credentials, and connected systems.
Learn more: CWE-94 — Improper Control of Generation of Code (Code Injection)
Impact Analysis
CVE-2025-49704 has a CVSS v3.1 base score of 8.8 (High) with severe real-world consequences amplified by confirmed ransomware exploitation. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requires only low-level privileges (PR:L) such as a standard SharePoint user account, and demands no user interaction (UI:N). All three CIA dimensions face high impact: Confidentiality (High) enables access to all documents, metadata, and credentials stored within SharePoint; Integrity (High) allows modification of content, configurations, and user permissions; and Availability (High) permits disruption of collaboration services across the organization. The confirmed ransomware association is critically important — threat actors are actively leveraging this vulnerability as an entry point for ransomware deployment across enterprise networks. With an EPSS score of 66.47% at the 98th percentile, organizations running SharePoint Server 2016 or 2019 face an extremely high risk of targeted exploitation.
Exploit Maturity
CVE-2025-49704 demonstrates critical exploit maturity with confirmed use in ransomware campaigns. CISA has added this vulnerability to the KEV catalog with the shortest possible remediation window — a deadline of July 23, 2025, just one day after listing — reflecting the extreme urgency. Microsoft has published both a security update guide and a dedicated blog post on disrupting active exploitation of SharePoint vulnerabilities. The EPSS score of 66.47% at the 98th percentile places this vulnerability among the most exploited in the wild. The ransomware designation by CISA indicates that threat actors are using CVE-2025-49704 as part of attack chains that culminate in data encryption and extortion, making it a top-priority remediation target for any organization running on-premises SharePoint Server.
Remediation
-
Disconnect EOL SharePoint versions and apply security updates. As directed by CISA, disconnect public-facing SharePoint Server instances that have reached end-of-life (including SharePoint Server 2013 and earlier). For supported versions (2016 and 2019), apply the security updates from the Microsoft Security Response Center immediately.
-
Follow Microsoft's active exploitation guidance. Review and implement the mitigations detailed in Microsoft's blog on disrupting SharePoint exploitation, which includes specific configuration changes and monitoring recommendations.
-
Restrict SharePoint access. Limit network exposure of SharePoint Server by placing it behind a VPN or reverse proxy, and enforce multi-factor authentication for all users. Review and minimize the number of accounts with write access to SharePoint sites.
-
Deploy ransomware-specific defenses. Given the confirmed ransomware exploitation, ensure endpoint detection and response (EDR) tools are deployed on SharePoint servers, implement network-level monitoring for lateral movement indicators, and verify that offline backups of critical SharePoint data exist and are current.
-
Investigate for compromise. Review SharePoint ULS logs, Windows Event Logs, and IIS logs for signs of code injection, unauthorized code execution, or data exfiltration. Check for unusual scheduled tasks, web shells, or unauthorized service accounts on the SharePoint server.
Technical Details
CVE-2025-49704 is a code injection vulnerability in Microsoft SharePoint Server with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in SharePoint's code generation logic where externally-influenced input from authenticated users is incorporated into dynamically constructed code without adequate sanitization or validation. An attacker with a valid SharePoint user account — even one with minimal permissions — can craft requests that inject malicious code into server-side processing, which SharePoint then executes within its application context. The unchanged scope (S:U) indicates that the impact remains within the SharePoint server boundary, though the high impact across all three CIA dimensions means the attacker gains effective control over the entire SharePoint environment. SharePoint Server 2016 and 2019 are confirmed affected, and the vulnerability is part of a broader campaign targeting on-premises SharePoint deployments as documented by Microsoft's security team.
Frequently Asked Questions
Is CVE-2025-49704 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-49704, including confirmed use in ransomware campaigns. Microsoft has published a dedicated blog post on disrupting the active exploitation of SharePoint vulnerabilities. The EPSS score of 66.47% at the 98th percentile confirms extremely high exploitation probability.
What products are affected by CVE-2025-49704?
Microsoft SharePoint Server 2016 and SharePoint Server 2019 are affected. Organizations running these on-premises versions must apply security updates immediately. SharePoint Online (Microsoft 365) is not affected by this vulnerability.
How do I fix CVE-2025-49704?
Apply the security updates from Microsoft's Security Response Center for SharePoint Server 2016 and 2019. Disconnect any end-of-life SharePoint versions. Follow the specific mitigation guidance in Microsoft's active exploitation blog post and implement ransomware defense measures.
How severe is CVE-2025-49704?
CVE-2025-49704 is rated High with a CVSS v3.1 score of 8.8 and carries a confirmed ransomware designation from CISA. The combination of authenticated code execution, ransomware exploitation, and a 98th percentile EPSS ranking makes this one of the most dangerous actively exploited vulnerabilities for enterprise environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.