CVE-2025-49706KEV · OVERDUECWE-287

Microsoft SharePoint Improper Authentication Vulnerability

Medium · published July 8, 2025

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

458
days past CISA
deadline
CVSS v3.1
6.5
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

⚠️ An unauthorized attacker could impersonate legitimate users in Microsoft SharePoint! This flaw in authentication is like a party crasher who sneaks in with a fake invite. 🎭 Think of SharePoint as a VIP club with a bouncer at the door. If the bouncer fails to check IDs properly, any random person could stroll in, pretending to be someone else, making it super easy for troublemakers to blend in. This vulnerability could allow an attacker to perform spoofing over a network, leading to unauthorized access to sensitive information and actions within SharePoint. Just imagine the chaos when someone can masquerade as a trusted user—data theft, misinformation, and a breach of trust are all on the table!

Put simply

Think of SharePoint as a VIP club with a bouncer at the door. If the bouncer fails to check IDs properly, any random person could stroll in, pretending to be someone else, making it super easy for troublemakers to blend in. CVE-2025-49706 stems from improper authentication mechanisms in Microsoft Office SharePoint, which can be exploited to let attackers impersonate other users without their consent, essentially bypassing security protocols meant to protect the system.

What to do

This vulnerability could allow an attacker to perform spoofing over a network, leading to unauthorized access to sensitive information and actions within SharePoint. Just imagine the chaos when someone can masquerade as a trusted user—data theft, misinformation, and a breach of trust are all on the table! To protect your SharePoint environment, ensure that you apply the latest security updates provided by Microsoft to patch this vulnerability. Additionally, review and enhance your authentication processes to ensure they meet best practices. Regularly audit user permissions to limit exposure. You've got this! Stay vigilant, and you'll have your SharePoint environment locked down in no time! 🛡️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.99095 · 99.9th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-07-08T21:15Z
KEV added
2025-07-22 · due 2025-07-23
Affected products (3)
ProductVersionsFixed in
microsoft/sharepoint_enterprise_serverall versions—
microsoft/sharepoint_server< 16.0.18526.2042416.0.18526.20424
microsoft/sharepoint_serverall versions—
References (3)
EPSS history
Timeline
  • 22 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 23
    kev
  • 08 JUL 16:58Z
    Microsoft SharePoint Server Spoofing Vulnerability
    cvelistv5