CVE-2025-49706: Microsoft SharePoint improper authentication vulnerability

CVE-2025-49706 · Severity: critical · CVSS 6.5 · Exploited in the wild · Published 2025-07-22

Microsoft SharePoint, a widely used platform for document management and collaboration, contains a security flaw that allows unauthorized individuals to impersonate legitimate users or services. An attacker can exploit this to view sensitive internal documents and make unauthorized changes to information. This vulnerability has been observed being used in active attacks, making immediate patching or disconnection of older, unsupported versions critical for protecting corporate data.

Technologies: Microsoft SharePoint, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition. Vendors: Microsoft.

Quick answers

Is CVE-2025-49706 exploited in the wild?
Yes. CVE-2025-49706 is known to be exploited in the wild, first recorded on 22 July 2025. Treat it as urgent.
How severe is CVE-2025-49706?
Critical severity, with a CVSS score of 6.5, published 22 July 2025.
Which products and versions are affected?
Microsoft SharePoint Server Subscription Edition before 16.0.18526.20424.
Is there a fix for CVE-2025-49706?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-49706 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-49706?
Check whether you run Microsoft SharePoint, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authentication vulnerability (CWE-287) exists in Microsoft SharePoint Server. The flaw allows an unauthenticated attacker to perform network-based spoofing, potentially leading to the disclosure of sensitive information and unauthorized data modification. The vulnerability is notable for being actively exploited in the wild and can be chained with other vulnerabilities like CVE-2025-49704. While Microsoft initially assigned a Medium severity CVSS score of 6.5, the vulnerability is categorized as Critical due to active exploitation. A patch bypass was later identified as CVE-2025-53771, requiring the latest updates for full remediation. Affected versions include SharePoint Enterprise Server 2016, 2019, and Subscription Edition.

Affected products

  • Microsoft SharePoint Enterprise Server 2016
  • Microsoft SharePoint Server 2019
  • Microsoft SharePoint Server Subscription Edition before 16.0.18526.20424

Timeline

  • 2025-07-16: disclosed: Initial NIST analysis and CPE assignment
  • 2025-07-22: advisory: Microsoft and CISA published advisories regarding active exploitation
  • 2025-07-22: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.