CVE-2025-49706
Published 2025-07-08 · Updated 2026-08-04 · Source secure@microsoft.com
Summary
CVE-2025-49706 is a medium-severity (CVSS 6.5) vulnerability in Microsoft SharePoint. CISA added it to the Known Exploited Vulnerabilities catalog on July 22, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 23, 2025. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.
All 390 known-exploited Microsoft vulnerabilities →Description
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA Known-Exploited Vulnerability
Product: Microsoft — SharePoint
Name: Microsoft SharePoint Improper Authentication Vulnerability
Date added: 2025-07-22 · Due: 2025-07-23
Required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.