CVE-2025-49704

🗓️ 08 Jul 2025 16:58:05Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 65 Media mentions👁 268 Views🌐 WEB

Improper control in Microsoft Office SharePoint allows code injection by authorized attackers remotely.

Reporter	Title	Published	Views	Family All 67
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	21 Jul 202518:43	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	22 Jul 202509:32	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	13 Aug 202512:52	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	4 Sep 202519:12	–	githubexploit
Information Security Automation	November “In the Trend of VM” (#21): vulnerabilities in Windows, SharePoint, Redis, XWiki, Zimbra Collaboration, and Linux	14 Nov 202520:44	–	avleonov
Information Security Automation	About Remote Code Execution – Microsoft SharePoint “ToolShell” (CVE-2025-49704) vulnerability	13 Nov 202513:56	–	avleonov
Information Security Automation	About Remote Code Execution – Microsoft SharePoint Server “ToolShell” (CVE-2025-53770) vulnerability	22 Jul 202515:18	–	avleonov
Information Security Automation	July Microsoft Patch Tuesday	16 Jul 202517:41	–	avleonov
BDU FSTEC	The vulnerability of the Microsoft SharePoint software package, related to improper code generation management, allows a malicious actor to execute arbitrary code.	14 Jul 202500:00	–	bdu_fstec
Circl	CVE-2025-49704	8 Jul 202503:00	–	circl

NVD

Vulners

CNA

Node

microsoft sharepoint_serverMatch2016enterprise

microsoft sharepoint_serverMatch2019

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Enterprise Server 2016",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5508.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server 2019",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.10417.20027",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
microsoft	www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
a	request body	/_layouts/15/ToolPane.aspx	Unauthenticated POST to ToolPane.aspx delivering a large payload to trigger CVE-2025-53770 RCE and retrieve malicious behavior.	CWE-94
DisplayMode	request body	/_layouts/15/ToolPane.aspx	Unauthenticated POST to ToolPane.aspx delivering a large payload to trigger CVE-2025-53770 RCE and retrieve malicious behavior.	CWE-94

13 Feb 2026 19:07Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.18.8

EPSS0.59583

SSVC

code injection microsoft office sharepoint security vulnerability network execution