Exploited vulnerability · CISA KEV

Is CVE-2025-49704 exploited? Yes: in CISA KEV since 22 Jul 2025

Gociux · Microsoft SharePoint · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2025-49704, Microsoft SharePoint Code Injection Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 22 Jul 2025, 14 days after it was published. It is known to be used in ransomware campaigns. It affects Microsoft SharePoint. If you run it, CISA's required action is: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

What it is

Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

What to do

1. Check whether you run it. Look for SharePoint in your asset inventory, including appliances and cloud images. Stack check lists every exploited Microsoft CVE at once.
2. Apply the fix. Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 8 Jul 2025.
4. Get told next time. Email alerts when CISA adds a CVE for Microsoft.

Other exploited CVEs in SharePoint

• CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability (25 Sep 2026)
• CVE-2026-55040: Microsoft SharePoint Weak Authentication Vulnerability (18 Aug 2026)
• CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (22 Jul 2026)
• CVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (16 Jul 2026)
• CVE-2026-20963: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (18 Mar 2026)
• CVE-2025-49706: Microsoft SharePoint Improper Authentication Vulnerability (22 Jul 2025)

References

• www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitati
• msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
• nvd.nist.gov/vuln/detail/CVE-2025-49704

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in July 2025 · Microsoft scorecard · act-now radar.