MEDIUM Actively exploited Used in ransomware CWE-287
CVE-2025-49706
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft·SharePoint
6.5/ 10
CVSS 3.1
Medium severity
100%
EPSS exploit odds
Chance of exploitation in the next 30 days
Among the very highest of all CVEs
Listed
CISA KEV catalog
- Added
- Jul 22, 2025
- Fix due
- Jul 23, 2025
- Ransomware
- Known use
Timeline
- Published
- Jul 8, 2025
- Updated
- Aug 4, 2026
- First covered
- Oct 2, 2026
- Latest story
- 1 month ago
Summary
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CWE-287Improper Authentication
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:CCISA required action
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Affected products
- Microsoft SharePoint Enterprise Server 201616.0.0 to before 16.0.5508.1000
- Microsoft SharePoint Server 201916.0.0 to before 16.0.10417.20027
- Microsoft SharePoint Server Subscription Edition16.0.0 to before 16.0.18526.20424