CVE-2025-49704

🗓️ 08 Jul 2025 16:58:05Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 65 Media mentions👁 322 Views🌐 WEB

Improper control in Microsoft Office SharePoint allows code injection by authorized attackers remotely.

Reporter	Title	Published	Views	Family All 67
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	21 Jul 202518:43	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	22 Jul 202509:32	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	13 Aug 202512:52	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	4 Sep 202519:12	–	githubexploit
Information Security Automation	November “In the Trend of VM” (#21): vulnerabilities in Windows, SharePoint, Redis, XWiki, Zimbra Collaboration, and Linux	14 Nov 202520:44	–	avleonov
Information Security Automation	About Remote Code Execution – Microsoft SharePoint “ToolShell” (CVE-2025-49704) vulnerability	13 Nov 202513:56	–	avleonov
Information Security Automation	About Remote Code Execution – Microsoft SharePoint Server “ToolShell” (CVE-2025-53770) vulnerability	22 Jul 202515:18	–	avleonov
Information Security Automation	July Microsoft Patch Tuesday	16 Jul 202517:41	–	avleonov
BDU FSTEC	The vulnerability of the Microsoft SharePoint software package, related to improper code generation management, allows a malicious actor to execute arbitrary code.	14 Jul 202500:00	–	bdu_fstec
Circl	CVE-2025-49704	8 Jul 202503:00	–	circl

NVD

Vulners

CNA

Node

microsoft sharepoint_serverMatch2016enterprise

microsoft sharepoint_serverMatch2019

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Enterprise Server 2016",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5508.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server 2019",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.10417.20027",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
microsoft	www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
DisplayMode	query param	_layouts/15/ToolPane.aspx	Unauthenticated POST exploiting ToolPane.aspx with manipulated query to reach RCE payload	CWE-94
a	query param	_layouts/15/ToolPane.aspx	Unauthenticated POST exploiting ToolPane.aspx with manipulated query to reach RCE payload	CWE-94
Payload	request body	_layouts/15/ToolPane.aspx	POST body carrying large base64-encoded PowerShell payload	CWE-94

17 Jun 2026 09:31Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.18.8

EPSS0.99915

SSVC

code injection microsoft office sharepoint security vulnerability network execution