CVE-2025-49704
Microsoft — Microsoft SharePoint Code Injection Vulnerability
CISA KEV · in the CISA KEV catalog since 2025-07-22
What EVULNABLE says
Listed in the CISA KEV catalog, and associated with known ransomware campaigns.
Patch Immediately
The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.
The evidence behind it
| Measure | Value | Source | What it means |
|---|---|---|---|
| CVSS base score | 8.8 | NVD | How severe the flaw is in itself. It does not say how likely an attack is. |
| FIRST EPSS | 0.999 (99.99th pctl) | FIRST | FIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. |
| Actively exploited | Confirmed | CISA KEV | Whether a source of record has confirmed attacks using it in the wild. |
| Ransomware campaign use | Known | CISA KEV | Whether CISA has seen ransomware operators use it. |
| CISA remediation deadline | 2025-07-23 — KEV since 2025 · listed over a year | CISA KEV | The date US federal agencies must have fixed or mitigated it. |
| Public exploit module | Public module exists | Metasploit | Module existing is not the same as active exploitation. |
| EUVD cross-reference | Listed | ENISA EUVD | ENISA's own vulnerability database entry for this CVE, where one exists. |
Impacted software or hardware
- sharepoint server Software — 2016, 2019
Remediation: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Remediation basis: CISA KEV required action
ENISA EUVD also lists this CVE at CVSS 8.8 (v3.1), assigned by microsoft. Source: euvd.enisa.europa.eu.
Metasploit lists a public excellent-rank module for this CVE: Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) (windows/http/sharepoint_toolpane_rce) — module existing is not the same as active exploitation; see metasploit.com.
The primary records
This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.
Where this sits
CVE-2025-49704 is a Microsoft entry in the CISA KEV catalog. The priority feed ranks Microsoft's current monthly release rather than older Microsoft CVEs, so this one is not listed there; the page above scores it from the same sources.