CVE-2025-49704: Microsoft SharePoint Server code injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, a near-maximum EPSS score, and a one-day federal remediation deadline.

What it is

Microsoft SharePoint Server contains a code injection flaw (CWE-94) that lets an authorized attacker execute code over the network. It is listed in CISA KEV with a one-day remediation deadline and is tied to known ransomware use, so it is a high-urgency target for defenders.

Impact

An authenticated attacker can run arbitrary code on the SharePoint server, gaining high confidentiality, integrity and availability impact. This can lead to full server compromise and use as a foothold for ransomware or lateral movement.

Attack surface

Reachable over the network via the SharePoint web interface (AV:N) with low attack complexity and no user interaction. The attacker must be authorized (PR:L), so valid credentials or an authenticated session are required.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS is near 1.0 (0.99995, 99.988th percentile). Microsoft published a security blog on disrupting active exploitation of on-premises SharePoint vulnerabilities.

What to do

• Apply the Microsoft security update for SharePoint Server immediately; prioritize internet-facing instances.
• For unsupported or EOL/EOS versions (SharePoint Server 2013 and earlier), disconnect them from public-facing exposure as directed by CISA.
• Follow CISA and Microsoft mitigation guidance for supported versions that cannot be patched immediately.
• Restrict and monitor authenticated access to SharePoint, and review accounts with elevated privileges.
• Adhere to BOD 22-01 guidance for cloud services or discontinue use if mitigations are unavailable.

Detection

• Hunt for unexpected w3wp.exe or SharePoint worker process spawning of cmd.exe, powershell.exe or other child processes.
• Monitor SharePoint logs and IIS logs for anomalous authenticated requests or code-injection patterns.
• Alert on new or modified files in SharePoint web directories and on suspicious outbound connections from SharePoint servers.
• Correlate authentication events with process creation on SharePoint hosts to spot post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.