What is the CVSS score of CVE-2025-49704?

CVE-2025-49704 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 63.8%.

Which versions of Sharepoint Server are affected by CVE-2025-49704?

Microsoft Office SharePoint (CVE-2025-49704) contains a critical code injection flaw exploited in active attacks that allows authenticated users to execute arbitrary code on SharePoint servers,…. A patch is available.

Is there a public PoC exploit available for CVE-2025-49704?

Yes, a public proof-of-concept exploit is available for CVE-2025-49704. Prioritise patching immediately. EPSS: 63.8%.

How to fix or mitigate CVE-2025-49704?

Within 24 hours: Identify all SharePoint deployments and current patch levels; verify CISA KEV status and prioritize systems by data sensitivity. Within 7 days: Apply Microsoft-released patch to all affected SharePoint instances and validate successful deployment. Within 30 days: Conduct access reviews of SharePoint accounts with elevated permissions; implement network segmentation to restrict SharePoint access to authorized users only; audit SharePoint logs for suspicious code execution or workflow modifications.

Sharepoint Server CVE-2025-49704

EUVD-2025-20554 HIGH

Code Injection (CWE-94)

2025-07-08 secure@microsoft.com

Microsoft RCE Code Injection Sharepoint Server

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:29 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.0.10417.20027,16.0.5508.1000

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20554

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

Added to CISA KEV

Oct 27, 2025 - 17:12 cisa

CISA KEV

CVE Published

Jul 08, 2025 - 17:15 nvd

HIGH 8.8

DescriptionCVE.org

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

AnalysisAI

Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated attackers to execute arbitrary code over the network. KEV-listed with EPSS 63.8%, this vulnerability requires only basic SharePoint authentication and enables server-level code execution, threatening the documents, workflows, and data stored across the organization's SharePoint infrastructure.

Technical ContextAI

The vulnerability allows authenticated SharePoint users to inject code that executes on the server side. In SharePoint environments, this is particularly impactful because: most employees have SharePoint accounts (large attack surface), SharePoint servers often store highly sensitive documents, and the SharePoint service account typically has broad infrastructure access.

RemediationAI

Apply Microsoft security update. Audit SharePoint service account permissions. Monitor for suspicious code execution on SharePoint servers. Review SharePoint access logs.