In CISA KEV8.8 HighCWE-94Ransomware use
CVE-2025-49704
Microsoft SharePoint Code Injection Vulnerability
MicrosoftSharePoint
Status
- Exploited in the wild
- In CISA KEV since 22 Jul 2025
- Vendor fix available
- Known ransomware use
Federal deadlineWed 23 Jul 2025, 23:59 UTC
Passed 458 days ago
CISA KEV · added 22 Jul 2025
Exploit probabilityEPSSchecked 23 Oct
99.9%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
8.8High
Description NVD
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CISA required action
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Coverage 1 article · 1 outlet
- Warlock Ransomware Group Augments Post-Exploitation ActivitiesDark Reading · first in our coverage · mentions it in passing