CVE-2025-49704

What it actually does

This is a network-reachable code-injection vulnerability in Microsoft Office SharePoint. An authenticated attacker can send crafted requests to a vulnerable SharePoint server and cause attacker-controlled code to execute in the SharePoint web application context. Successful exploitation can lead to server-side command execution, web shell deployment, access to SharePoint content, theft of configuration secrets, credential material exposure, and follow-on movement into identity, file, and collaboration infrastructure.

Why it matters to the business

Because SharePoint commonly stores sensitive business documents and is often integrated with identity and internal applications, exploitation can result in data theft, service disruption, ransomware deployment, and compromise of adjacent systems. The vulnerability is listed in CISA KEV, has been observed in active exploitation, is associated with ransomware activity, and has an extremely high EPSS score, so organizations should treat exposed or internet-accessible SharePoint servers as high-priority remediation targets. CISA’s KEV remediation due date was 2025-07-23, meaning unpatched systems are materially overdue for remediation.

How an attack unfolds

An attacker first obtains valid SharePoint credentials or otherwise gains an authenticated session. They then identify a vulnerable SharePoint instance and send specially crafted HTTP requests that trigger improper code generation handling in SharePoint. If exploitation succeeds, the attacker gains the ability to execute code through the SharePoint web application process. From there, common post-exploitation behavior includes writing an ASPX web shell, executing commands through w3wp.exe, harvesting SharePoint configuration data, extracting credentials or signing material, accessing document libraries, and moving laterally into identity or file infrastructure. In campaigns associated with ToolShell and ransomware activity, SharePoint compromise may be used as an initial foothold for persistence, credential theft, data staging, and eventual encryption or extortion operations.

How to fix it

Apply the relevant Microsoft security updates for all supported SharePoint Server versions and ensure every SharePoint server in every farm is updated, including front-end, application, search, and distributed cache roles. Because no exact fixed versions were provided in the input, use Microsoft’s official security update guidance for CVE-2025-49704 and verify the installed SharePoint build is at or above the fixed build for the deployed product line. If immediate patching is not possible, restrict SharePoint access to trusted networks or VPN, disable unnecessary external exposure, enforce MFA for SharePoint and administrator access, enable Microsoft Defender Antivirus and AMSI integration for SharePoint where supported, monitor and block suspicious child processes from IIS worker processes, and remove unsupported SharePoint versions from service. After patching, rotate credentials and secrets that may have been exposed, especially farm accounts, service accounts, application pool identities, machine keys, certificates, and privileged identity credentials if compromise is suspected.

How to confirm the fix worked

Confirm remediation by inventorying all SharePoint servers and verifying their installed build numbers against Microsoft’s fixed versions for this vulnerability. Check that all farm members report the same expected patched build and that no server remains on an older cumulative or security update level. Validate that externally reachable SharePoint endpoints are minimized and protected by strong authentication. Run authenticated vulnerability scans or configuration checks that specifically validate SharePoint security update level rather than relying only on banner detection. Review IIS, SharePoint ULS, Windows Event, PowerShell, Defender, and EDR telemetry for signs of exploitation before declaring the issue fully remediated, because patching prevents future exploitation but does not remove web shells or attacker persistence already present.

Typical attack path

1. Acquire valid SharePoint credentials or an authenticated session.
2. Probe the SharePoint server to confirm version, exposed endpoints, and exploitability.
3. Send crafted authenticated HTTP requests that trigger the code-injection flaw.
4. Execute code in the SharePoint web application context, commonly through the IIS worker process.
5. Deploy or invoke a web shell or command-execution mechanism for persistence.
6. Collect SharePoint configuration files, secrets, document data, and credential material.
7. Use harvested access to move laterally into identity, file, virtualization, or management infrastructure.
8. Stage data for exfiltration and, in ransomware campaigns, deploy encryption or disruption tooling.

How to detect it

Investigate whether exploitation already occurred by correlating IIS access logs, SharePoint ULS logs, Windows Security events, PowerShell logs, Defender/EDR alerts, file creation events, and network egress from SharePoint servers. Look for authenticated requests to SharePoint layout or administrative endpoints followed by server-side errors, unusual ASPX file creation, or command execution by the IIS worker process. High-value signals include w3wp.exe spawning cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, mshta.exe, rundll32.exe, regsvr32.exe, or encoded PowerShell; newly written ASPX files under SharePoint TEMPLATE or LAYOUTS paths; modifications to web.config; suspicious outbound connections from SharePoint servers; unusual access to configuration databases or credential material; and bulk document access or downloads shortly after suspicious requests. For ToolShell- or ransomware-associated activity, also hunt for web shells, credential dumping, archive creation, data staging directories, lateral movement attempts, and ransomware pre-encryption behaviors such as disabling security tools or deleting shadow copies.

• /_layouts/15/ToolPane.aspx
• DisplayMode=Edit
• w3wp.exe
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• powershell.exe -EncodedCommand
• cmd.exe /c
• certutil.exe -urlcache
• bitsadmin.exe /transfer
• rundll32.exe
• regsvr32.exe
• mshta.exe
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\CONTROLTEMPLATES\
• web.config
• spinstall0.aspx
• .aspx
• vssadmin.exe delete shadows
• wmic.exe shadowcopy delete
• wevtutil.exe cl
• bcdedit.exe /set {default} recoveryenabled no

What your security team should do

• Immediately patch all SharePoint servers, prioritizing internet-facing systems and farms that handle sensitive business data.
• Treat this as an active-exploitation and ransomware-relevant vulnerability due to KEV status, ransomware association, and very high EPSS probability.
• Perform threat hunting for web shells, suspicious ASPX files, and IIS worker process child processes on all SharePoint servers.
• Review SharePoint, IIS, Windows Security, PowerShell, Defender, and EDR logs for exploitation attempts and post-exploitation activity dating back before the published date of 2025-07-08.
• Restrict SharePoint administrative and user access to trusted networks where feasible and enforce MFA for all remote and privileged access.
• Rotate SharePoint farm, service, application pool, and privileged credentials if exploitation is suspected or cannot be ruled out.
• Audit document access and downloads for unusual bulk access, access from unfamiliar IP addresses, or activity outside normal business patterns.
• Check for persistence mechanisms, scheduled tasks, new local users, modified web.config files, suspicious IIS modules, and unauthorized ASPX files.
• Ensure reliable offline or immutable backups exist for SharePoint content databases, configuration databases, and dependent identity systems.
• Escalate incident response if indicators show command execution, web shell placement, credential theft, or ransomware staging.