Patchfirst
Patchfirst
CVE-2025-49704 KEVRansomwarePublic exploit High · 8.8 EPSS >99.9%

Microsoft SharePoint Code Injection Vulnerability

Microsoft · SharePoint

Summary

The flaw is an improper control of code generation (code injection) in Microsoft Office SharePoint, affecting the SharePoint product. An attacker who holds an authorized, low-privileged account and can reach the service over the network can execute code on the affected system, without needing any user interaction.

Official description · NVD

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Breakdown
83.0 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 10 days after disclosure. Public exploit code (Metasploit) was available the same day.

  1. DisclosedPublic exploit codeMetasploitday 0
  2. First seen exploitedVulnCheck KEV evidence+10 days
  3. Named in a threat reportresearch.eye.security+11 days
  4. Added to CISA KEVknown ransomware use; EU database agrees+14 days

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Exploit Public-Facing Application T1190
MITRE CTID mapping of the KEV entry · how it is exploited

When chained with CVE-2025-49706, this vulnerability allows for an attacker to send a malicious __VIEWSTATE object to the same endpoint that the POST requests were sent to. This exploits a code injection flaw and allows for code execution.

ExecutionTA0002

Windows Command Shell T1059.003
MITRE CTID mapping of the KEV entry · primary impact

Detection

0 rules for this CVE · 195 general rules for its techniques

Rules for this CVE

0 that reference CVE-2025-49704 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Windows Command ShellT1059.00346 general rules
All 46 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportresearch.eye.securityJul 2025

Reports are matched by finding the exact id CVE-2025-49704 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

research.eye.security19 Jul 2025

SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Research SharePoint 0-day uncovered (CVE-2025-53770)

After some digging, we learned that three days earlier, the offensive security team from Code White GmbH demonstrated they could reproduce an unauthenticated RCE exploit chain in SharePoint, a combination of two bugs presented at Pwn2Own Berlin earlier this year in May: CVE-2025-49706 & CVE-2025-49704.

3 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag

Vendor Advisory 2

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704
↑ ↓ chooseEnter openEsc close