HIGH Actively exploited Used in ransomware CWE-94
CVE-2025-49704
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft·SharePoint
8.8/ 10
CVSS 3.1
High severity
>99.9%
EPSS exploit odds
Chance of exploitation in the next 30 days
Among the very highest of all CVEs
Listed
CISA KEV catalog
- Added
- Jul 22, 2025
- Fix due
- Jul 23, 2025
- Ransomware
- Known use
Timeline
- Published
- Jul 8, 2025
- Updated
- Feb 13, 2026
- First covered
- Oct 2, 2026
- Latest story
- 1 month ago
Summary
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CWE-94Improper Control of Generation of Code ('Code Injection')
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:CCISA required action
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Affected products
- Microsoft SharePoint Enterprise Server 201616.0.0 to before 16.0.5508.1000
- Microsoft SharePoint Server 201916.0.0 to before 16.0.10417.20027