CVE-2025-49706

Timeline

Detection, updates, and resolution for this record.

1. Jul 8, 2025 · Catalog

   Detected

   Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for

2. Jul 22, 2025 · CISA KEV

   Known exploited

   Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or disc

3. Jul 23, 2025 · CISA KEV

   Remediation due

   Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or disc

4. Aug 3, 2026 · Catalog

   Updated

   Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for

Affected

• cpe microsoft/sharepoint enterprise server2016
• cpe microsoft/sharepoint serverversion unspecified
• cpe microsoft/sharepoint server2019
• vendor Microsoft SharePointversion unspecified

Sources

• CISA KEVCVE-2025-49706

  Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for

  cisa.gov
• CVE.orgCVE-2025-49706

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2025-49706

  30-day exploitation probability 99.1%

  first.org
• Metasploit Modulesexploit_windows/http/sharepoint_toolpane_rce

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2025-49706

  Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

  nvd.nist.gov

References

• CISA note · msrc.microsoft.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• CISA note · cisa.gov
• CISA note · microsoft.com