CVE-2025-49704
Published 2025-07-08 · Updated 2026-06-17 · Source secure@microsoft.com
Summary
CVE-2025-49704 is a high-severity (CVSS 8.8) vulnerability in Microsoft SharePoint. CISA added it to the Known Exploited Vulnerabilities catalog on July 22, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 23, 2025. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.
All 390 known-exploited Microsoft vulnerabilities →Description
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Microsoft — SharePoint
Name: Microsoft SharePoint Code Injection Vulnerability
Date added: 2025-07-22 · Due: 2025-07-23
Required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.