{"id":"CVE-2025-49706","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-49706","generatedAt":"2026-10-28T03:29:34.188Z","title":"Microsoft SharePoint Improper Authentication Vulnerability","description":"Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.","published":"2025-07-08T17:15:58.000Z","lastModified":"2026-08-04T05:16:35.000Z","status":"Analyzed","sourceIdentifier":"secure@microsoft.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-287"],"affected":["microsoft/sharepoint enterprise server","microsoft/sharepoint server"],"epss":{"score":0.99057,"percentile":0.99931,"date":"2026-10-26","history":[]},"kev":{"listed":true,"dateAdded":"2025-07-22","dueDate":"2025-07-23","knownRansomwareCampaignUse":"Known","notes":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.\nCISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 ; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49706"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 23 July 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706","tags":["Vendor Advisory"],"source":"secure@microsoft.com"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","tags":["Press/Media Coverage","Vendor Advisory"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-49706","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}