CVE-2025-49704: high-severity vulnerability in Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CISC Gov.br · 15 Jul 2025Zero-Days TOOLSHELL - SharePoint Serversread on gov.br ↗
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
An attacker with authorized access to Microsoft SharePoint can inject and execute malicious code on the server. This is dangerous because it allows the attacker to take full control of the SharePoint environment and access sensitive data.
Code injection vulnerability in SharePoint's code generation mechanism allows authenticated attackers to execute arbitrary code remotely via improper input validation. The attack requires valid credentials but can result in complete server compromise with access to all hosted data and resources.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.