CVE-2025-49706 Microsoft SharePoint Improper Authentication
An unauthorized attacker can perform spoofing attacks against Microsoft SharePoint Server due to improper authentication mechanisms.
- Exploited in the wild
- Since 22 Jul 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-49706?
CVE-2025-49706 is a medium-severity authentication bypass vulnerability in Microsoft Sharepoint Enterprise Server, published on 8 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Weakness: CWE-287
Which versions are affected by CVE-2025-49706?
It affects 2 products.
Products include Microsoft Sharepoint Enterprise Server, Microsoft Sharepoint Server.
How do I fix CVE-2025-49706?
No fix has been published for CVE-2025-49706 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Jul 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-49706 being exploited?
Yes. Attackers have exploited CVE-2025-49706 in the wild since at least 22 Jul 2025, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Sharepoint Enterprise Server
- CVE-2019-0604 Microsoft SharePoint Remote Code Execution
- CVE-2023-24955 Microsoft SharePoint Server Code Injection
- CVE-2020-1210 Microsoft SharePoint Remote Code Execution Vulnerability
- CVE-2020-1595 Microsoft SharePoint Remote Code Execution Vulnerability
- CVE-2025-47163 Microsoft SharePoint Server Remote Code Execution Vulnerability
Sources
Also known as GHSA-j67g-r75f-8hgp.