CVE-2025-49706

What it actually does

CVE-2025-49706 is an improper authentication flaw in Microsoft Office SharePoint that allows an unauthenticated network attacker to spoof identity or trust context and access functionality that should require authentication. In real-world activity, this class of SharePoint authentication bypass has been used as part of exploit chains, including ToolShell-related campaigns, to reach privileged SharePoint endpoints, bypass normal access controls, and enable follow-on actions such as web shell deployment, credential or token theft, persistence, lateral movement, and ransomware staging. The standalone CVSS score is moderate, but the EPSS score is extremely high, it is listed in CISA KEV, and it has been associated with ransomware activity, making the operational risk high for exposed SharePoint servers.

Why it matters to the business

Successful exploitation can allow attackers to compromise SharePoint, a platform that often stores sensitive documents, internal communications, business workflows, and integration credentials. Compromise can lead to data theft, manipulation of trusted content, account compromise, interruption of collaboration services, and ransomware deployment across connected infrastructure. Because this vulnerability is known to be exploited in the wild, is in CISA KEV with a remediation due date of 2025-07-23, and is associated with ransomware campaigns, internet-facing or externally reachable SharePoint deployments should be treated as high-priority exposure even though the base CVSS score is 6.5.

How an attack unfolds

An attacker first identifies a reachable on-premises SharePoint server and fingerprints its version and exposed SharePoint application endpoints. The attacker then sends crafted HTTP requests that abuse the improper authentication behavior to make SharePoint accept a spoofed or unintended trust context. Once authentication controls are bypassed, the attacker accesses endpoints or functions that should not be available anonymously. In observed ToolShell-style activity, the authentication bypass may be chained with additional SharePoint vulnerabilities to execute code, write ASPX web shells into SharePoint layout directories, extract machine keys or tokens, and use the SharePoint worker process as a launch point for discovery, credential theft, persistence, and ransomware staging. Threat activity associated with this vulnerability includes SharePoint and identity compromise campaigns against retail, ToolShell exploitation, and Q3 2025 ransomware campaigns targeting edge and virtualization infrastructure.

How to fix it

Apply the relevant Microsoft security updates for all supported on-premises Microsoft SharePoint installations immediately, prioritizing internet-facing systems and systems reachable by partners, VPN users, or untrusted network segments. Because no exact fixed versions were provided in the input, use Microsoft’s official guidance for CVE-2025-49706 and install the July 2025 or later cumulative/security updates applicable to SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 where supported. Ensure all SharePoint servers in a farm are patched consistently, then run the SharePoint Products Configuration Wizard or equivalent post-update configuration steps required by Microsoft. If immediate patching is not possible, remove external access, restrict SharePoint to trusted networks, enforce WAF or reverse-proxy filtering for suspicious SharePoint layout and ToolPane requests, disable unnecessary public exposure, monitor for web shell creation, and rotate credentials or secrets if compromise is suspected. Unsupported SharePoint versions should be upgraded or isolated because they may not receive complete fixes.

How to confirm the fix worked

Confirm that every SharePoint server in each farm is running a Microsoft-supported version and has the applicable July 2025 or later security update installed. Validate from both the operating system patch inventory and SharePoint build/version reporting, because SharePoint farms can remain partially updated if post-patch configuration steps are skipped. Verify that the SharePoint Products Configuration Wizard completed successfully on all farm members. From an unauthenticated network vantage point, confirm that SharePoint endpoints do not expose administrative, layout, or ToolPane functionality without authentication. Review reverse proxy, WAF, and IIS logs to confirm that suspicious unauthenticated requests to SharePoint layout paths are blocked or no longer produce abnormal responses. Finally, search SharePoint web directories for unauthorized ASPX files and compare against a known-good baseline.

Typical attack path

1. Scan the internet or target network ranges for exposed Microsoft SharePoint servers.
2. Fingerprint SharePoint build, exposed paths, and patch level using HTTP responses and SharePoint-specific endpoints.
3. Send crafted unauthenticated requests that exploit improper authentication to spoof identity or trust context.
4. Access SharePoint functionality that should require authentication.
5. Chain the bypass with another SharePoint flaw or misconfiguration to upload files, invoke server-side functionality, or execute commands.
6. Deploy an ASPX web shell or equivalent persistence mechanism under SharePoint web-accessible directories.
7. Use the SharePoint application pool identity and w3wp.exe process context to run discovery, credential collection, and lateral movement commands.
8. Steal SharePoint secrets, authentication material, documents, or configuration data.
9. Stage additional tooling, exfiltrate data, or deploy ransomware across reachable systems.

How to detect it

Investigate historical exposure by reviewing IIS logs, SharePoint ULS logs, Windows Security logs, EDR telemetry, WAF/reverse-proxy logs, and file integrity monitoring for the period before and after patching. Focus on unauthenticated or unusual requests to SharePoint layout endpoints, especially ToolPane and SignOut-related request patterns, abnormal HTTP POSTs, unexpected 200 responses to paths normally requiring authentication, and requests followed by ASPX file creation. On hosts, look for unauthorized files in SharePoint web-accessible directories, especially TEMPLATE\LAYOUTS paths, recently modified ASPX files, and files with names that imitate legitimate SharePoint installation components. In process telemetry, prioritize w3wp.exe spawning cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, certutil.exe, rundll32.exe, regsvr32.exe, bitsadmin.exe, net.exe, nltest.exe, whoami.exe, or archive tools. In Windows logs, look for new local or domain accounts, new services, scheduled tasks, suspicious logons from SharePoint servers, credential access events, and lateral movement originating from SharePoint application servers. If ToolShell or ransomware activity is suspected, preserve memory, collect web directories and IIS logs before cleanup, rotate secrets, and perform full incident response rather than treating patching alone as sufficient.

• /_layouts/15/ToolPane.aspx?DisplayMode=Edit
• /_layouts/SignOut.aspx
• POST /_layouts/15/ToolPane.aspx
• GET /_layouts/15/ToolPane.aspx
• spinstall0.aspx
• spinstall.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\spinstall0.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall.aspx
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\spinstall.aspx
• \TEMPLATE\LAYOUTS\spinstall0.aspx
• \TEMPLATE\LAYOUTS\spinstall.aspx
• w3wp.exe spawned cmd.exe
• w3wp.exe spawned powershell.exe
• w3wp.exe spawned certutil.exe
• w3wp.exe spawned rundll32.exe
• w3wp.exe spawned mshta.exe
• w3wp.exe spawned bitsadmin.exe
• w3wp.exe spawned net.exe
• w3wp.exe spawned nltest.exe
• cmd.exe /c whoami
• powershell -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer

What your security team should do

• Patch or isolate all externally reachable on-premises SharePoint servers immediately; treat this as emergency work because it is KEV-listed, has a very high EPSS score, and is associated with ransomware activity.
• Determine whether any SharePoint servers were exposed to the internet or untrusted networks before patching and place those systems into a compromise-assessment workflow.
• Search IIS, SharePoint ULS, WAF, EDR, and proxy logs for ToolShell-style requests, suspicious unauthenticated access to /_layouts/ paths, ASPX web shell creation, and w3wp.exe spawning command-line tools.
• Hunt for known SharePoint web shell filenames and unexpected ASPX files under SharePoint TEMPLATE\LAYOUTS directories.
• If exploitation is suspected, rotate SharePoint farm credentials, service account passwords, machine keys, certificates, OAuth/secrets, and any credentials stored in or accessible from SharePoint.
• Block direct internet access to SharePoint where business requirements allow; place SharePoint behind strong authentication, conditional access, VPN, or a hardened reverse proxy.
• Increase monitoring for ransomware precursors, including archive creation, bulk document access, credential dumping, remote service creation, and lateral movement from SharePoint servers.
• Review threat intelligence for ToolShell, SharePoint identity compromise, and Q3 2025 ransomware campaigns and map observed IOCs to existing SIEM and EDR detections.