CVE-2025-49706
Microsoft SharePoint Improper Authentication Vulnerability
Description
CVE-2025-49706 is a medium-severity improper authentication vulnerability in Microsoft SharePoint Server that allows an unauthenticated attacker to perform spoofing attacks over the network. The vulnerability affects SharePoint Enterprise Server 2016 and SharePoint Server 2019 (versions prior to 16.0.18526.20424). While rated 6.5 (Medium) on the CVSS v3.1 scale, its significance is elevated by CISA's confirmation that it is being used in ransomware campaigns alongside related SharePoint vulnerabilities such as CVE-2025-49704 and CVE-2025-53770. CISA has issued an aggressive remediation deadline of July 23, 2025, and the EPSS score of 65.00% at the 98th percentile places this vulnerability among the most likely to be exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint enterprise server | 2016 |
| microsoft | sharepoint server | < 16.0.18526.20424; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706(US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/(Press/Media Coverage, Vendor Advisory)
Weakness Type
CWE-287: Improper Authentication
CVE-2025-49706 is classified under CWE-287, which describes vulnerabilities where an application does not properly verify that a user or entity has the claimed identity. In Microsoft SharePoint Server, the authentication mechanism fails to properly validate certain requests, allowing an unauthenticated attacker to perform spoofing operations. This improper authentication can enable the attacker to impersonate legitimate users or services, bypass access controls, and gain unauthorized access to SharePoint resources without providing valid credentials.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2025-49706 carries a CVSS v3.1 base score of 6.5 (Medium), but its real-world impact is significantly amplified by its role in active ransomware attack chains. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and demands no user interaction (UI:N). Confidentiality is partially impacted (C:L) as the spoofing attack enables limited unauthorized data access, and Integrity is partially impacted (I:L) as the attacker can modify some data through impersonation. While the individual CVSS score is medium, this vulnerability is commonly chained with CVE-2025-49704 and CVE-2025-53770 in coordinated SharePoint exploitation campaigns. When combined with these higher-severity code injection and deserialization vulnerabilities, CVE-2025-49706 can serve as an initial access vector that bypasses authentication, enabling subsequent exploitation that leads to full server compromise and ransomware deployment.
Exploit Maturity
CVE-2025-49706 has confirmed active exploitation with a known ransomware association. CISA has added this vulnerability to the KEV catalog with a one-day remediation deadline of July 23, 2025, reflecting maximum urgency. Microsoft has published both a security update guide and a detailed blog post on disrupting active SharePoint exploitation that covers this vulnerability as part of a broader campaign. The EPSS score of 65.00% at the 98th percentile confirms near-certain exploitation activity. While CVE-2025-49706 has a lower individual severity rating than its companion SharePoint vulnerabilities, it plays a key role in attack chains where the authentication bypass enables subsequent exploitation of more severe flaws.
Remediation
-
Apply security updates immediately. Install the latest patches for SharePoint Enterprise Server 2016 and SharePoint Server 2019 from the Microsoft Security Response Center. Update SharePoint Server 2019 to version 16.0.18526.20424 or later.
-
Disconnect end-of-life SharePoint instances. As directed by CISA, disconnect public-facing SharePoint Server versions that have reached end-of-life, including SharePoint Server 2013 and earlier, which no longer receive security updates.
-
Implement authentication hardening. Enable multi-factor authentication for all SharePoint access, enforce strong password policies, and review authentication configurations for any non-standard or weakened settings. Monitor authentication logs for anomalous patterns.
-
Address the full SharePoint vulnerability chain. Remediate CVE-2025-49706 alongside CVE-2025-49704 and CVE-2025-53770, as these vulnerabilities are being exploited together in ransomware campaigns. Follow Microsoft's exploitation disruption guidance for comprehensive mitigation.
-
Deploy network-level protections. Place SharePoint Server behind a VPN or reverse proxy, implement IP-based access restrictions, and deploy web application firewall rules to detect and block spoofing attempts targeting authentication endpoints.
Technical Details
CVE-2025-49706 is an improper authentication vulnerability in Microsoft SharePoint Server with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. The vulnerability resides in SharePoint's authentication handling logic, where certain network requests are not properly validated against the claimed identity of the requester. This allows an unauthenticated attacker to craft requests that bypass authentication checks and perform spoofing operations — impersonating legitimate users or services to access or modify SharePoint resources without valid credentials. The unchanged scope (S:U) indicates the impact stays within the SharePoint boundary, and the low confidentiality and integrity impacts (C:L, I:L) reflect the limited direct damage from the spoofing alone. However, in the context of the broader SharePoint exploitation campaign documented by Microsoft, this authentication bypass serves as a critical first step in attack chains that escalate to full code execution through CVE-2025-49704 or CVE-2025-53770. Affected versions include SharePoint Enterprise Server 2016 and SharePoint Server 2019 prior to version 16.0.18526.20424.
Frequently Asked Questions
Is CVE-2025-49706 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-49706 and has designated it with a known ransomware association. Microsoft's security team has documented it as part of an active campaign targeting on-premises SharePoint deployments.
What products are affected by CVE-2025-49706?
Microsoft SharePoint Enterprise Server 2016 and SharePoint Server 2019 (versions prior to 16.0.18526.20424) are affected. SharePoint Online is not impacted.
How do I fix CVE-2025-49706?
Apply Microsoft's security updates for SharePoint Enterprise Server 2016 and SharePoint Server 2019. Address this vulnerability alongside CVE-2025-49704 and CVE-2025-53770, as they are exploited together. Disconnect any end-of-life SharePoint versions from the network.
How severe is CVE-2025-49706?
While the individual CVSS v3.1 score is 6.5 (Medium), the real-world severity is significantly higher due to its confirmed use in ransomware campaigns and its role as an initial access vector in SharePoint attack chains. The 98th percentile EPSS ranking confirms it is among the most actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.