CVE-2025-49706: Microsoft SharePoint Vulnerability

What is CVE-2025-49706?

Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.

Impact Analysis

Exploitation Probability (EPSS): 73.8% chance of exploitation in the next 30 days (99th percentile). This places the vulnerability in the highest risk tier — immediate action is critical.

Exploit Availability

Public exploit code or proof-of-concept is available for CVE-2025-49706. This significantly increases the risk of exploitation, as attackers can use or adapt existing exploit code rather than developing their own. A public exploit reference has been identified. Organizations should treat this as an urgent patching priority.

Is CVE-2025-49706 being exploited?

Yes. CVE-2025-49706 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, restricted to CVEs with confirmed active exploitation in the wild. CISA added this vulnerability on 2025-07-22. Inclusion in KEV triggers the patching mandate under BOD 22-01 for U.S. federal civilian agencies, with a remediation deadline of 2025-07-23. Additionally, public exploit code is available, which lowers the barrier for attackers.

How to fix CVE-2025-49706

Apply the latest security update via Windows Update, WSUS, or Microsoft Update Catalog. For enterprise environments, use SCCM/Intune for managed deployment. If the patch cannot be applied immediately, check the MSRC advisory for workarounds such as registry-based mitigations or disabling affected features. Check the Microsoft Security Response Center page for the specific patch or update. CISA's Known Exploited Vulnerabilities catalog requires U.S. federal agencies to remediate this vulnerability by the due date shown below under Binding Operational Directive 22-01. Private organizations should treat KEV entries as priority-one patches because active exploitation has been confirmed in the wild.

Related Vulnerabilities

Other actively exploited vulnerabilities affecting SharePoint:

• CVE-2026-20963 (Critical 9.8) [same product] — Deserialization of untrusted data in Microsoft Office SharePoint allows an…
• CVE-2025-49704 (High 8.8) [same product] — Improper control of generation of code ('code injection') in Microsoft Office…
• CVE-2025-53770 (Unknown N/A) [same product] — Microsoft SharePoint Server on-premises contains a deserialization of…
• CVE-2008-4250 (Critical 9.8) [same vendor] — The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003…
• CVE-2009-1537 (High 8.8) [same vendor] — Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll…

Frequently asked questions

Is CVE-2025-49706 critical?

CVE-2025-49706 has a CVSS 3.1 base score of N/A — Unknown severity. Prioritize based on exposure and the active exploitation signal from the KEV listing. The availability of public exploit code further increases the urgency.

Is CVE-2025-49706 being actively exploited?

Yes — CISA added CVE-2025-49706 to the Known Exploited Vulnerabilities catalog on 2025-07-22. Inclusion in KEV means CISA has confirmed in-the-wild exploitation. Public exploit code has also been identified, making exploitation accessible to a broader range of threat actors.

How do I patch CVE-2025-49706?

Apply the security update from Microsoft for SharePoint. Federal agencies must remediate by 2025-07-23 under BOD 22-01. Refer to the Microsoft Security Response Center for the official patch.

What is the CVSS score for CVE-2025-49706?

CVE-2025-49706 has a CVSS 3.1 base score of N/A, classifying it as Unknown severity.