CVE-2025-49706: Microsoft SharePoint improper authentication enables spoofing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCISA KEV listing with a one-day due date, known ransomware campaign use, and an EPSS probability above 0.99 indicate active, high-impact exploitation despite the medium CVSS score.

What it is

Microsoft SharePoint Server and SharePoint Enterprise Server contain an improper authentication flaw (CWE-287) that lets an unauthorized attacker perform spoofing over the network. The vulnerability is remotely reachable without credentials or user interaction, and CISA added it to the Known Exploited Vulnerabilities catalog with a one-day remediation due date, indicating active exploitation.

Impact

An unauthenticated attacker can impersonate a legitimate user or service, undermining trust in SharePoint authentication and potentially enabling follow-on access or data manipulation. The CVSS impact is limited to low confidentiality and integrity, but the spoofing primitive can be a stepping stone in a broader intrusion.

Attack surface

Reachable over the network via the SharePoint web interface with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed SharePoint instance is a candidate target.

Exploitation

Listed in CISA KEV on 2025-07-22 with a 2025-07-23 due date and flagged for known ransomware campaign use; EPSS 30-day probability is 0.99063 (99.9th percentile). Microsoft published a security blog on 2025-07-22 about disrupting active exploitation of on-premises SharePoint vulnerabilities.

What to do

• Apply the Microsoft security update for CVE-2025-49706 immediately; treat patching as the primary action.
• For unsupported or end-of-life SharePoint Server 2013 and earlier, disconnect from public-facing exposure as directed by CISA.
• For supported versions, follow CISA and Microsoft mitigation guidance; if mitigations are unavailable, discontinue use per BOD 22-01.
• Restrict or remove direct internet exposure of on-premises SharePoint until patched.
• Review BOD 22-01 cloud service guidance and apply equivalent controls where SharePoint is cloud-hosted.

Detection

• Hunt SharePoint logs for authentication anomalies, spoofed identities, or unexpected successful logins from unfamiliar source IPs.
• Monitor for exploitation attempts against SharePoint endpoints using Microsoft's published indicators and the vendor security blog.
• Alert on new or modified SharePoint web components, layouts, or configuration files that could indicate post-exploitation persistence.
• Correlate SharePoint access logs with outbound network activity for signs of follow-on compromise or ransomware staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.