# CVE-2025-49704: Microsoft SharePoint code injection vulnerability

Source: https://junglewise.ai/threats/cve-2025-49704-microsoft-sharepoint-code-injection-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-22. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-49704 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-07-22

Microsoft SharePoint, a widely used collaboration and document management platform, contains a vulnerability that allows attackers to run unauthorized code on the server. An attacker with basic user permissions can exploit this flaw to take control of the system, potentially leading to data theft or service disruption. This vulnerability has been observed being used in active attacks, making immediate patching or decommissioning of older versions critical.

Technologies: [Microsoft SharePoint](https://junglewise.ai/threats/technologies/sharepoint), [Microsoft SharePoint Server 2016 Enterprise Edition](https://junglewise.ai/threats/technologies/sharepoint-server-2016-enterprise-edition), [Microsoft SharePoint Server 2019](https://junglewise.ai/threats/technologies/sharepoint-server-2019). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2025-49704 exploited in the wild?** Yes. CVE-2025-49704 is known to be exploited in the wild, first recorded on 22 July 2025. Treat it as urgent.

**How severe is CVE-2025-49704?** Critical severity, with a CVSS score of 8.8, published 22 July 2025.

**Which products and versions are affected?** Microsoft SharePoint Server 2013 End of Life.

**Is there a fix for CVE-2025-49704?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-49704 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-49704?** Check whether you run Microsoft SharePoint, Microsoft SharePoint Server 2013, Microsoft SharePoint Server 2016 Enterprise Edition or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability (CWE-94) exists in Microsoft SharePoint Server due to improper control of code generation. An attacker with low-privileged 'Authorized' access can exploit this over the network without user interaction to achieve remote code execution (RCE). The vulnerability is known to be exploited in the wild and can be chained with CVE-2025-49706. Notably, a patch bypass (CVE-2025-53770) was later identified, requiring administrators to apply the most recent cumulative updates to ensure full remediation. Affected versions include SharePoint Server 2016 and 2019, while EOL versions like 2013 remain permanently vulnerable.

## Affected products

- Microsoft SharePoint Server 2016 Enterprise Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2013 End of Life

## Timeline

- 2025-07-08: disclosed: Initial disclosure by Microsoft
- 2025-07-22: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-07-22: advisory: Microsoft blog post regarding active exploitation published

## Related threats

- [Microsoft SharePoint deserialization code execution](https://junglewise.ai/threats/cve-2026-120000-deserialization-of-untrusted-data-in-microsoft-office-sharepoint)
- [Microsoft SharePoint incorrect authorization privilege escalation](https://junglewise.ai/threats/cve-2026-102862-incorrect-authorization-in-microsoft-office-sharepoint-allows-an)
- [Microsoft SharePoint time-of-check time-of-use race condition](https://junglewise.ai/threats/cve-2026-69804-microsoft-sharepoint-time-of-check-time-of-use-race-condition)
- [Microsoft SharePoint missing authorization in code execution](https://junglewise.ai/threats/cve-2026-69724-microsoft-sharepoint-missing-authorization-in-code-execution)
- [Microsoft SharePoint code injection](https://junglewise.ai/threats/cve-2026-65660-microsoft-sharepoint-code-injection)