CVE DatabaseCVE-2025-49704

Updated 2026-06-17한국어 권고문 →

CVE-2025-497048.8/HIGHCISA KEVCWE-94

Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-49704)

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

sharepoint, sharepoint server

Published Date

2025-07-08

CVSS v3.1

8.8

HIGH

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

On-premises Microsoft SharePoint Server 2016, 2019, and Subscription Edition

Impact

An authorized attacker can inject and execute arbitrary code over the network, leading to complete system compromise

Mitigation

Immediately apply the official Microsoft security patches and restrict network access to SharePoint management endpoints

Affected Products & Version Scope

Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (On-premises deployments)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Refer to the Microsoft Security Update Guide to download and install the appropriate Cumulative Update (CU) for your SharePoint version. Use the following PowerShell commands to verify your current SharePoint farm build version and patch status.

powershell

# Verify SharePoint Farm Build Version
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
Get-SPFarm | Select-Object BuildVersion

# Check Installation Status of SharePoint Products and Patches
Get-SPProduct | Select-Object -ExpandProperty Servers | Select-Object Name, InstallStatus

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict external access to the SharePoint Central Administration and sensitive API endpoints. Use the following PowerShell commands to configure IIS IP address restrictions.

powershell

# Enable IIS IP and Domain Restrictions Feature
Install-WindowsFeature Web-IP-Security

# Restrict Access to SharePoint Web Site to Trusted Subnets Only
Import-Module WebAdministration
Set-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name 'allowUnlisted' -Value $false -PSPath 'IIS:\sites\SharePoint - 80'
Add-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name '.' -Value @{ipAddress='10.0.0.0';subnetMask='255.0.0.0';allowed='true'} -PSPath 'IIS:\sites\SharePoint - 80'

3. Log Audit & IoC Verification Commands

Monitor IIS logs and Windows Event Logs for anomalous process creation, specifically looking for instances where the IIS worker process (w3wp.exe) spawns command shells or scripting engines.

powershell

# Detect Anomalous Child Processes Spawned by IIS Worker Process (w3wp.exe)
Get-CimInstance Win32_Process | Where-Object {
    $_.ParentProcessId -in (Get-Process -Name w3wp -ErrorAction SilentlyContinue).Id
} | Select-Object ProcessId, Name, CommandLine, CreationDate | Format-Table -AutoSize

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild, immediately apply the official Microsoft security updates to mitigate this high-severity threat.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-49704) is a code injection vulnerability (CWE-94) existing in Microsoft SharePoint Server. The root cause lies in the improper control and validation of input generation or object instantiation within the SharePoint application framework. This allows an authenticated attacker to submit crafted payloads that are dynamically compiled or executed within the application context.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first obtain valid credentials with low-level privileges on the target SharePoint environment. The attacker then transmits a malicious payload via specific API endpoints or web part parameters. Due to unsafe deserialization or dynamic code execution flaws, the SharePoint server processes the payload, executing arbitrary commands under the security context of the IIS worker process (w3wp.exe).

3. Infrastructure & Business Impact

This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation allows threat actors to bypass security controls, exfiltrate sensitive corporate data, perform lateral movement within the Active Directory domain, and deploy ransomware, posing a severe threat to organizational infrastructure.

Official Vendor Advisories & References

NVD Original English Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704

Source: secure@microsoft.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Vendor Advisory

Frequently Asked SecOps Questions (CVE-2025-49704)

FAQ

Q1. How critical is CVE-2025-49704 and is it actively exploited in the wild?

CVE-2025-49704 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-49704?

Primary impacted vendors include microsoft across sharepoint, sharepoint server. Scope summary: Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (On-premises deployments)

Q3. What temporary mitigations or workarounds exist for CVE-2025-49704 before patching?

[Mitigation] Immediately apply the official Microsoft security patches and restrict network access to SharePoint management endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION