CVE-2025-62204CWE-502insecure-deserialization

CVE-2025-62204

High · published November 11, 2025

CVSS v3.1
8.0
EPSS
2%
Percentile
82.4
In the wild
Unconfirmed
What it is

⚡ A crafty authorized attacker can exploit this flaw in Microsoft Office SharePoint to execute code over a network — like a mischievous guest sneaking into your kitchen and mixing up all the recipes! 🔥 Imagine you're at a dinner party, and one of the guests is allowed in the kitchen. If they start switching ingredients without anyone noticing, the results could be catastrophic! This vulnerability is just as sneaky, allowing unauthorized code execution through deserialization of untrusted data. An attacker could take control over the network, executing malicious code that could lead to data breaches, unauthorized access to sensitive information, or even full system compromise. The consequences could be absolutely devastating for your organization’s security and reputation!

Put simply

Imagine you're at a dinner party, and one of the guests is allowed in the kitchen. If they start switching ingredients without anyone noticing, the results could be catastrophic! This vulnerability is just as sneaky, allowing unauthorized code execution through deserialization of untrusted data. This vulnerability arises from the deserialization of untrusted data in Microsoft Office SharePoint, which allows an attacker to send crafted data that the application processes without proper validation. This means the attacker can manipulate the application's behavior and execute arbitrary code remotely.

What to do

An attacker could take control over the network, executing malicious code that could lead to data breaches, unauthorized access to sensitive information, or even full system compromise. The consequences could be absolutely devastating for your organization’s security and reputation! To protect your systems, update Microsoft Office SharePoint to the latest version as soon as possible, and review your network security policies. Regular audits of system access permissions are also recommended to safeguard against unauthorized access. You've got this! With these steps, you’ll be on your way to locking things down and keeping your network secure! 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02208 · 82.4th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-11-11T23:15Z
Affected products (3)
ProductVersionsFixed in
microsoft/sharepoint_server< 16.0.19127.2033816.0.19127.20338
microsoft/sharepoint_serverall versions—
microsoft/sharepoint_serverall versions—
References (1)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Microsoft SharePoint Remote Code Execution Vulnerability
    cvelistv5