In CISA KEV6.5 MediumCWE-287Ransomware use
CVE-2025-49706
Microsoft SharePoint Improper Authentication Vulnerability
MicrosoftSharePoint
Status
- Exploited in the wild
- In CISA KEV since 22 Jul 2025
- Vendor fix available
- Known ransomware use
Federal deadlineWed 23 Jul 2025, 23:59 UTC
Passed 458 days ago
CISA KEV · added 22 Jul 2025
Exploit probabilityEPSSchecked 25 Oct
99.0%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
6.5Medium
Description NVD
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CISA required action
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Coverage 1 article · 1 outlet
- Warlock Ransomware Group Augments Post-Exploitation ActivitiesDark Reading · first in our coverage