CVE-2025-49706

🗓️ 08 Jul 2025 16:58:07Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 60 Media mentions👁 287 Views🌐 WEB

Improper authentication in Microsoft Office SharePoint allows network spoofing by authorized attackers.

Reporter	Title	Published	Views	Family All 68
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	21 Jul 202518:43	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	22 Jul 202509:32	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	11 Feb 202619:56	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	13 Aug 202512:52	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	4 Sep 202519:12	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	21 Jul 202514:19	–	githubexploit
Information Security Automation	About Remote Code Execution – Microsoft SharePoint “ToolShell” (CVE-2025-49704) vulnerability	13 Nov 202513:56	–	avleonov
Information Security Automation	About Remote Code Execution – Microsoft SharePoint Server “ToolShell” (CVE-2025-53770) vulnerability	22 Jul 202515:18	–	avleonov
Circl	CVE-2025-49706	8 Jul 202503:00	–	circl
CISA KEV Catalog	Microsoft SharePoint Improper Authentication Vulnerability	22 Jul 202500:00	–	cisa_kev

NVD

Vulners

CNA

Node

microsoft sharepoint_enterprise_serverMatch2016

microsoft sharepoint_serverRange<16.0.18526.20424subscription

microsoft sharepoint_serverMatch2019

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Enterprise Server 2016",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5508.1000",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server 2019",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.10417.20027",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SharePoint Server Subscription Edition",
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.18526.20424",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
microsoft	www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

Parameter	Position	Path	Description	CWE
MSOTlPn_Uri	request body	/_layouts/15/ToolPane.aspx	Untrusted payload via ToolPane.aspx POST with GZIP+Base64 data to trigger RCE in SharePoint on-prem.	CWE-287
MSOTlPn_DWP	request body	/_layouts/15/ToolPane.aspx	Untrusted payload via ToolPane.aspx POST with GZIP+Base64 data to trigger RCE in SharePoint on-prem.	CWE-287
CompressedDataTable	request body	/_layouts/15/ToolPane.aspx	Untrusted payload via ToolPane.aspx POST with GZIP+Base64 data to trigger RCE in SharePoint on-prem.	CWE-287

13 Feb 2026 19:07Current

7.5High risk

Vulners AI Score7.5

CVSS 3.16.5

EPSS0.74988

SSVC