CVE-2025-49706

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706	US Government Resource
https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/	Press/Media Coverage Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:::::::*
	cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::*
	cpe:2.3:a:microsoft:sharepoint_server:2019:::::::*

History

No history.

Information

Published : 2025-07-08 17:15

Updated : 2025-10-27 17:12

NVD link : CVE-2025-49706

Mitre link : CVE-2025-49706

CVE.ORG link : CVE-2025-49706

JSON object : View

Products Affected

microsoft

sharepoint_server
sharepoint_enterprise_server

CWE

CWE-287

Improper Authentication

{"id": "CVE-2025-49706", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-07-08T17:15:58.250", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706", "tags": ["US Government Resource"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "tags": ["Press/Media Coverage", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network."}, {"lang": "es", "value": "La autenticaci\u00f3n incorrecta en Microsoft Office SharePoint permite que un atacante autorizado realice suplantaci\u00f3n de identidad a trav\u00e9s de una red."}], "lastModified": "2025-10-27T17:12:29.023", "cisaActionDue": "2025-07-23", "cisaExploitAdd": "2025-07-22", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C082CC4-6128-475D-BC19-B239E348FDB2"}, {"criteria": "cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*", "vulnerable": true, "matchCriteriaId": "B006E0D5-DEDF-490A-9BC6-D2DC34DF98B2", "versionEndExcluding": "16.0.18526.20424"}, {"criteria": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6122D014-5BF1-4AF4-8B4D-80205ED7785E"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]", "cisaRequiredAction": "Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.", "cisaVulnerabilityName": "Microsoft SharePoint Improper Authentication Vulnerability"}