CVE-2025-49704

CVE-2025-49704: Microsoft SharePoint Server Code Injection Under Active Exploitation

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2025-49704 is a high-severity code injection vulnerability in Microsoft Office SharePoint Server. An attacker with low-privilege access can inject and execute arbitrary code on the target server over the network without requiring user interaction. The vulnerability carries a CVSS v3.1 score of 8.8 and has been added to CISA's Known Exploited Vulnerabilities catalog, with evidence of active exploitation by ransomware groups.

Background

Microsoft SharePoint Server is a widely deployed on-premises collaboration and document management platform used by enterprises globally. The 2016 and 2019 releases remain prevalent in organizations that have not migrated to SharePoint Online. In July 2025, Microsoft disclosed this flaw alongside active exploitation campaigns targeting on-premises SharePoint installations, prompting an emergency security response.

Root Cause

The vulnerability is classified under CWE-94: Improper Control of Generation of Code (code injection). The root cause lies in insufficient input validation and sanitization within SharePoint's request handling pipeline, which allows an authenticated attacker to supply malicious input that is subsequently evaluated or executed as code by the server. Because the application fails to adequately control code generation, attacker-controlled data can alter the intended control flow and achieve arbitrary code execution in the context of the SharePoint application or underlying server.

Impact

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H translates to:

• Attack Vector (Network): Exploitable remotely over the network.
• Attack Complexity (Low): No special conditions or complex prerequisites required.
• Privileges Required (Low): The attacker needs only low-level authorized access.
• User Interaction (None): No victim interaction is necessary.
• Scope (Unchanged): The vulnerable component is the only one impacted.
• Confidentiality, Integrity, Availability (All High): Successful exploitation grants the attacker full read, write, and destroy capabilities on the server.

Given active exploitation and a ransomware nexus, this is not merely a theoretical server compromise risk — it has been observed in the wild as an initial access vector leading to data encryption, exfiltration, and business disruption.

Exploitation Walkthrough

Ethics Notice: The following is a generic, defender-oriented description of exploitation mechanics. No weaponized code or step-by-step attack instructions are provided.

An attacker with valid low-privilege credentials (or a compromised low-privilege account) interacts with a vulnerable SharePoint endpoint. By crafting a request that embeds malicious input in a field processed by SharePoint's backend, the attacker causes the server to evaluate that input as executable code. Because the flaw is in the code-generation path, the attacker's payload runs with the privileges of the SharePoint application worker process or the underlying web server. With network access and no user interaction required, this can be automated at scale against exposed SharePoint instances.

Affected and Patched Versions

Based on the source data, the following products are affected:

• Microsoft SharePoint Server 2016 (Enterprise)
• Microsoft SharePoint Server 2019

Specific patch levels or KB article numbers were not included in the source CVE record. Administrators should consult the Microsoft Security Response Center (MSRC) advisory for the definitive list of patched builds and security update packages.

Remediation

1. Apply Security Updates: Install the latest Microsoft security updates for SharePoint Server 2016 and 2019 as detailed in the MSRC advisory. Prioritize patching any internet-facing or perimeter-accessible SharePoint farms.
2. Network Segmentation: Restrict network access to SharePoint administration and application endpoints to trusted internal IP ranges. Block unnecessary outbound connections from SharePoint servers.
3. Web Application Firewall (WAF): Deploy or tune WAF rules to detect anomalous requests targeting SharePoint code-execution paths. Use this as a compensating control until patching is complete.
4. Credential Hygiene: Enforce multi-factor authentication (MFA) for all SharePoint accounts and rotate credentials if compromise is suspected. Low-privilege accounts remain a viable foothold for this attack.
5. Least Privilege: Review and minimize SharePoint service account and application pool privileges to reduce the blast radius of a successful exploit.

Detection

• Monitor SharePoint application and IIS logs for unusual HTTP requests to endpoints associated with code evaluation or dynamic compilation.
• Alert on unexpected process spawning by SharePoint worker processes (w3wp.exe), especially command-line interpreters or scripting engines.
• Deploy endpoint detection and response (EDR) on SharePoint servers and hunt for file-system anomalies, credential dumping, or lateral-movement indicators.
• Correlate authentication logs with known-compromised or low-privilege accounts making anomalous API or web requests.

Assessment

This vulnerability exemplifies how a single code-injection flaw in a core enterprise collaboration platform can escalate into a widespread ransomware event. The EPSS score of 0.99907 (99.9th percentile) reflects extremely high real-world exploit probability, and inclusion in the CISA KEV catalog on 2025-07-22 confirms confirmed in-the-wild usage. The European Union vulnerability database (EUVD-2025-20554) also flags it as actively exploited from the same date.

Key lessons:

1. Input validation failures in code-generation paths remain a critical and recurrent source of high-severity vulnerabilities in enterprise software.
2. On-premises SharePoint deployments without rapid patch cadences are attractive, durable targets for ransomware actors.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704
• https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/