CVE-2025-49706

This is a weakness in how SharePoint checks who's really making a request — like a security guard who can be fooled into thinking an outsider is an authorized employee. Attackers are already using this trick, combined with other flaws, to break into company SharePoint servers and lock up data with ransomware. It only affects companies that run their own SharePoint server in-house, not those using Microsoft's cloud-hosted SharePoint Online.

This matters to you if you run Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition on your own infrastructure. It does not affect SharePoint Online / Microsoft 365 cloud subscriptions. Risk is highest if your SharePoint server is exposed to the public internet.

Attackers are already exploiting this flaw in active ransomware campaigns, and it is officially listed by CISA as a known exploited vulnerability with a required remediation deadline that has already passed. Any internet-facing, unpatched on-premises SharePoint server should be treated as likely under attack right now. This is a red-alert, act-today situation, not a routine patch cycle.

1. Inventory all on-premises SharePoint deployments (Enterprise Server 2016, Server 2019, Subscription Edition) and identify any that are internet-facing. 2. If a server is end-of-life/end-of-service (e.g., SharePoint 2013 or earlier) and public-facing, disconnect it immediately per CISA KEV guidance — no patch exists for EOL versions. 3. For supported versions, apply the fixed builds: 16.0.5508.1000 (Enterprise Server 2016), 16.0.10417.20027 (Server 2019), 16.0.18526.20424 (Subscription Edition / generic sharepoint server). 4. Note this CVE (auth bypass/spoofing) is typically chained with other SharePoint RCE vulnerabilities in the 'ToolShell' exploitation chain attributed to the Warlock ransomware actor — patching this CVE alone may not be sufficient; apply all related SharePoint security updates from the same advisory. 5. CISA's remediation due date for this KEV entry was 2025-07-23 — if not yet remediated, you are past deadline and should treat this as an emergency. 6. As a temporary workaround if patching is delayed, follow Microsoft's and CISA's published mitigation guidance (network isolation, WAF rules, disabling exposed endpoints) referenced in the MSRC and Microsoft Security Blog links. 7. Post-patch, rotate machine keys/ASP.NET validation keys on affected SharePoint farms and review IIS/SharePoint logs for indicators of compromise, given confirmed ransomware use.

CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), weakness CWE-287 (Improper Authentication) enabling spoofing over the network without authentication or user interaction. Confirmed in CISA KEV with ransomware use by the Warlock actor; remediation due date 2025-07-23 has passed. Only a detection template exists publicly (no full public exploit code noted), but real-world exploitation chains this flaw with related SharePoint RCE CVEs ('ToolShell'). Predictive risk scoring (EPSS) is superseded here by confirmed in-the-wild exploitation.