CVE-2025-49706: medium-severity vulnerability in Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server Spoofing Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CISC Gov.br · 15 Jul 2025Zero-Days TOOLSHELL - SharePoint Serversread on gov.br ↗
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Microsoft SharePoint Server has an authentication flaw that allows attackers to impersonate legitimate users or administrators over a network without proper credentials. This can lead to unauthorized access to sensitive documents and data.
An improper authentication mechanism in Microsoft Office SharePoint (CWE-287) permits network-based spoofing attacks where an attacker can forge or bypass authentication checks to assume the identity of authorized users. This requires network access to the SharePoint instance and can result in unauthorized information disclosure and data manipulation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.