CVE-2025-59228CWE-20

CVE-2025-59228

High · published October 14, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
71.6
In the wild
Unconfirmed
What it is

⚡ An authorized user can exploit improper input validation in Microsoft Office SharePoint to execute code over the network! That's like inviting a friend over and finding out they let themselves into your whole system! 🔥 Picture this: you’ve got a high-security vault, but the guard is too friendly and lets anyone in without checking their identity. That’s what’s going on here; the system trusts inputs it shouldn’t, and an attacker can take advantage of that to run any code they please! The stakes are high! An attacker could gain unauthorized access to sensitive data or potentially control the entire SharePoint environment. This could lead to devastating data breaches and operational disruption, making your network an open playground for malicious activities.

Put simply

Picture this: you’ve got a high-security vault, but the guard is too friendly and lets anyone in without checking their identity. That’s what’s going on here; the system trusts inputs it shouldn’t, and an attacker can take advantage of that to run any code they please! This vulnerability arises from improper input validation within Microsoft Office SharePoint, allowing an authenticated attacker to send malicious payloads that execute code over the network.

What to do

The stakes are high! An attacker could gain unauthorized access to sensitive data or potentially control the entire SharePoint environment. This could lead to devastating data breaches and operational disruption, making your network an open playground for malicious activities. Immediate action is needed! Ensure you apply the latest security patches from Microsoft for SharePoint. Additionally, review user permissions and limit access to authorized personnel to minimize potential impacts. You’ve got this! Follow these steps, and you’ll be reinforcing your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01363 · 71.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-10-14T21:16Z
Affected products (3)
ProductVersionsFixed in
microsoft/sharepoint_server< 16.0.19127.2026216.0.19127.20262
microsoft/sharepoint_serverall versions—
microsoft/sharepoint_serverall versions—
References (1)
EPSS history
Timeline
  • 14 OCT 17:00Z
    Microsoft SharePoint Remote Code Execution Vulnerability
    cvelistv5