What breaks and who should care
If your organisation runs Microsoft SharePoint and you have a public‑facing instance, you need to know about CVE-2025-49704 right now. It is a code‑injection flaw that lets an authorised attacker run arbitrary code over the network. The vulnerability is rated 8.8 on the CVSS scale – that is high – and it has been confirmed in the wild. Ransomware actors are already using it, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed it in its Known Exploited Vulnerabilities catalogue.
Related remediation guides
Other vulnerabilities in the same family or affecting the same products:
- CVE-2025-53770 SharePoint Server – Immediate Action Guide
- CVE-2026-45659 – SharePoint Server deserialization flaw – what it means and how to fix it
- Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
What the vulnerability is
The NVD description classifies CVE-2025-49704 as a code‑injection issue in SharePoint. In plain English, a specially crafted request can cause the server to treat attacker‑supplied data as executable code. The result is remote code execution (RCE) without needing to break authentication first – the attacker only needs a valid, authorised account.
The public details stop at the class of the flaw. Microsoft has not released a technical write‑up that explains the exact payload format or the vulnerable component name. In short, the mechanism is not publicly documented beyond the fact that it is a code‑injection vector that works over the network.
How bad is it really?
A CVSS score of 8.8 puts this in the high‑severity bucket. The impact metrics are clear: an attacker can execute code, potentially install ransomware, steal data, or pivot to other systems. Because the vulnerability can be chained with another flaw that bypasses patches, the overall attack surface is larger than the score alone suggests.
CISA’s decision to add it to the Known Exploited Vulnerabilities catalogue is a strong signal. The agency only does that when there is reliable evidence of active exploitation. Ransomware groups have already incorporated this flaw into their toolkits, meaning that any unpatched, internet‑exposed SharePoint server is a prime target.
Do you have an exposed SharePoint instance?
First, confirm whether you are running SharePoint at all. If you are, ask yourself two questions:
- Is the server reachable from the public internet?
- Is the server still receiving security updates from Microsoft?
If the answer to either question is yes, you are in the risk set. CISA explicitly requires organisations to disconnect public‑facing SharePoint servers that have reached end‑of‑life or end‑of‑service. That includes any SharePoint Server that stopped receiving updates several years ago.
How to check your environment
Open a PowerShell prompt with administrative rights and run the following command to list installed SharePoint updates:
Get-HotFix | Where-Object {$_.Source -like "*SharePoint*"}
If the command returns any entries, note the KB numbers – you will need them when you compare against the patch list in the table below.
Next, verify whether the server is listening on a public IP address. On the server, run:
Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.PrefixOrigin -eq "Dhcp" -or $_.PrefixOrigin -eq "Manual"}
If any of the addresses belong to a range that is routable on the internet (for example, not a private 10.x, 172.16.x, or 192.168.x block), the server is publicly reachable.
What to do if you are vulnerable
The cleanest solution is to apply the Microsoft‑provided patch. The table below, automatically generated from the NVD, shows which releases contain the fix. Look for the entry that matches the KB numbers you saw in the Get-HotFix output and upgrade to that patched release for your branch.
In practice, that means running the standard SharePoint update process – either via Windows Update, WSUS, or the Microsoft Update Catalog – and confirming that the KB for this vulnerability is present.
Step‑by‑step patching
- Back up your SharePoint farm. Take a full database backup and a file system snapshot.
- Download the correct update. Use the Microsoft Update Catalog, search for the KB number that addresses CVE-2025-49704, and download the package that matches your server architecture.
- Install the update. Run the installer, following the on‑screen prompts. The installer will stop SharePoint services, apply the fix, and restart the services.
- Validate the installation. After the reboot, run
Get-HotFixagain and confirm the KB appears in the list. - Test functionality. Verify that your sites load, that custom solutions still work, and that no errors appear in the ULS logs.
If a patch is not yet available
In the rare case that you cannot apply a patch immediately – perhaps because you are on a custom build or you are waiting for a change‑management window – you must mitigate the risk while you wait.
- Isolate the server. Remove any inbound internet routing to the SharePoint web front‑end. Use firewall rules to allow only internal IP ranges.
- Restrict privileged accounts. Ensure that only a handful of tightly controlled service accounts have write access to SharePoint libraries.
- Enable web‑application firewalls. A WAF can block suspicious payloads that attempt the injection pattern, even if it cannot stop a determined attacker.
- Monitor logs closely. Turn on verbose logging for SharePoint and for IIS. Look for unusual HTTP requests that contain encoded scripts or unusually long query strings.
While these steps do not replace a proper patch, they raise the bar for an attacker and buy you time.
Long‑term hardening recommendations
Even after you have patched, treat SharePoint as a high‑value target. Follow these best practices:
- Keep the server on a dedicated subnet and enforce strict network segmentation.
- Apply the principle of least privilege to all SharePoint service accounts.
- Regularly audit installed updates – run
Get-HotFixon a schedule and compare against the official patch list. - Review external exposure quarterly. If a public‑facing SharePoint instance is not required, move it behind a VPN or retire it entirely.
What to do next
1. Run the PowerShell checks above.
2. Compare the KB numbers you see with the table below.
3. If the patched KB is missing, schedule an immediate update.
4. If you cannot patch today, apply the mitigation steps and document your plan.
Remember: the vulnerability is already being used in ransomware campaigns. The longer a vulnerable, internet‑exposed SharePoint server stays unpatched, the higher the chance it will be hit.
Reference table
The table below is pulled directly from the NVD and lists the affected and fixed releases for CVE-2025-49704. Use it to verify that your environment is running a version that includes the fix.
See the table below.
Affected versions
NVD has not published machine-readable version ranges for CVE-2025-49704 yet. Check the vendor advisory for the exact affected and fixed releases before you plan an upgrade.
