EUVD-2025-20554Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.8 (High). KEV-listed — actively exploited. EPSS 63.8% — very high exploitation probability. Requires only basic authentication. SharePoint is ubiquitous in enterprises. Server-level code execution. |
| Exploit ScenarioDerived | An attacker with compromised SharePoint credentials (or an insider) injects malicious code through the SharePoint interface. The server executes the injected code, providing access to: all SharePoint document libraries across the organization, SharePoint databases containing user data and configurations, the server's filesystem and network connections for lateral movement, and the service account's domain privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated attackers to execute arbitrary code over the network. KEV-listed with EPSS 63.8%, this vulnerability requires only basic SharePoint authentication and enables server-level code execution, threatening the documents, workflows, and data stored across the organization's SharePoint infrastructure.
Earlier versions of this analysis (1)
SharePoint contains a code injection vulnerability (CWE-94) that allows authenticated network users to inject and execute arbitrary code on the SharePoint server.
RemediationAI
Apply Microsoft security update. Audit SharePoint service account permissions. Monitor for suspicious code execution on SharePoint servers. Review SharePoint access logs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability allows authenticated SharePoint users to inject code that executes on the server side. In SharePoint environments, this is particularly impactful because: most employees have SharePoint accounts (large attack surface), SharePoint servers often store highly sensitive documents, and the SharePoint service account typically has broad infrastructure access.
Know when Sharepoint Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Executive ViewAI
Microsoft Office SharePoint (CVE-2025-49704) contains a critical code injection flaw exploited in active attacks that allows authenticated users to execute arbitrary code on SharePoint servers, compromising organizational documents, workflows, and sensitive data. With confirmed active exploitation and a high probability of attack (EPSS 63.8%), this vulnerability poses immediate risk to any organization running SharePoint and requires urgent remediation to prevent unauthorized access and data exfiltration.
Apply vendor patch. Pending patch deployment, restrict SharePoint access to trusted internal networks only, disable SharePoint workflows in non-production environments, implement multi-factor authentication for all SharePoint user accounts, and monitor Windows event logs on SharePoint servers for unexpected process execution or code injection attempts.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise acr
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
GitHub PoC
Exploit-DB