CVE-2025-49704

This is a flaw in Microsoft's self-hosted SharePoint software — the kind businesses install on their own servers to share documents internally. It's like a side door into the building that lets someone who's already shown a basic ID slip past the guard and plant whatever they want inside, including ransomware that locks up all your files.

This matters to you if you run SharePoint Server 2016 or SharePoint Server 2019 on your own infrastructure. It does not affect Microsoft 365 / SharePoint Online (Microsoft's cloud version). If you still run SharePoint Server 2013 or earlier, there is no fix at all and it should be taken offline if exposed to the internet.

Attackers are already exploiting this vulnerability in active ransomware campaigns, with a specific threat actor (Warlock) using it to break into organizations' SharePoint servers right now. This is on the US government's official list of flaws known to be exploited, with an emergency fix deadline that has already passed. Treat this as an active, ongoing attack, not a theoretical risk.

Confirm exposure by identifying any internet-facing or internally-reachable on-premises SharePoint Server instances and their build numbers. Target fixed builds: SharePoint Enterprise Server 2016 → 16.0.5508.1000+, SharePoint Server 2019 → 16.0.10417.20027+ (apply via standard SharePoint update mechanisms; test in staging if downtime-sensitive, but given active exploitation prioritize speed over caution). SharePoint Server 2013 and earlier have no fix — disconnect public-facing instances per CISA KEV guidance. CISA's remediation due date (2025-07-23) has already passed, so treat any unpatched instance as a confirmed incident risk. No reliable workaround exists short of patching or disconnection; this vulnerability is typically chained with other SharePoint CVEs (the ToolShell chain) to achieve pre-auth or authenticated RCE. After patching, hunt for indicators of prior compromise (webshells, unusual IIS worker process activity, anomalous SharePoint service account logins) since exploitation predates patch availability. Monitor Microsoft MSRC and CISA KEV advisories for updated guidance.

CVSS 3.1: 8.8 (High), AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, requires low-privilege authentication, no user interaction, full compromise of confidentiality/integrity/availability. Weakness: CWE-94 (Code Injection). Confirmed in CISA KEV as of 2025-07-22 with active ransomware exploitation attributed to the Warlock actor as part of the broader 'ToolShell' SharePoint exploitation chain; CISA remediation deadline (2025-07-23) has passed. No public exploit code is on record, but real-world exploitation is confirmed, superseding predictive scoring. Press coverage is sustained and incident-driven, consistent with active ransomware intrusions rather than mere research interest.