Is CVE-2025-49704 actively exploited?

Yes. CVE-2025-49704 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2025-49704 be exploited remotely?

The attack vector of CVE-2025-49704 has not been classified yet.

What is the CVSS score of CVE-2025-49704?

CVE-2025-49704 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2025-49704

HIGHCISA KEVIN THE WILD

CVE-2025-49704

Published: July 22, 2025

EPSS:66.47%probability of exploitation in 30 daysPercentile:98.5th

Official Description

Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

NVD Source

CISA KEV Advisory

Microsoft SharePoint Code Injection Vulnerability

Added to KEV: 2025-07-22Federal patch deadline: 2025-07-23⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Risk Analysis

This code injection vulnerability in Microsoft SharePoint allows an authorized attacker to execute code over a network. This flaw is particularly concerning as it can be chained with other vulnerabilities, and a patch bypass (CVE-2025-53770) exists. The high EPSS score of 0.66469 and its presence in CISA's KEV confirm active exploitation.

This vulnerability is actively being exploited in the wild and can be chained with other flaws. It allows authorized attackers to execute code remotely.

Recommended Action

Apply the most robust updates available for Microsoft SharePoint, specifically those addressing CVE-2025-53770, which provides more comprehensive protection than the initial CVE-2025-49704 patch. Ensure all SharePoint servers are fully patched and hardened.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-49704 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2025-49704 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.