CVE-2025-49706
MEDIUM KEV RANSOMWARE NUCLEIMicrosoft SharePoint Enterprise Server - Improper Authentication
Title source: llmExploitation Summary
CVE-2025-49706 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 22, 2025, with confirmed use in ransomware campaigns.
EIP tracks 3 public exploits from researchers including AdityaBhatt3010, Viettel Cyber Security, sfewer-r7, including a Metasploit module exploits/windows/http/sharepoint_toolpane_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2025-49706, a spoofing vulnerability in Microsoft SharePoint Server. It includes root cause analysis, exploitation steps, detection methods, and mitigation strategies, but does not contain functional exploit code.
Description
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Exploits (3)
This repository provides a detailed technical analysis of CVE-2025-49706, a spoofing vulnerability in Microsoft SharePoint Server. It includes root cause analysis, exploitation steps, detection methods, and mitigation strategies, but does not contain functional exploit code.
This repository contains a detailed technical analysis of CVE-2025-53770, an unauthenticated RCE vulnerability in Microsoft SharePoint, including root cause, attack flow, and mitigation strategies.
This Metasploit module exploits CVE-2025-53771, an authentication bypass vulnerability in Microsoft SharePoint Server, combined with unsafe deserialization (CVE-2025-49704) to achieve unauthenticated remote code execution. It targets vulnerable SharePoint versions by leveraging a gadget chain in the DataSetSurrogateSelector class.
Nuclei Templates (1)
http.component:"sharepoint"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N