Microsoft SharePoint Server Spoofing Vulnerability

cisa required action Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

1. 2025-07-08 First public exploit (Metasploit exploit/windows/http/sharepoint_toolpane_rce)
2. 2025-07-08 Published
3. 2025-07-22 CISA SSVC: exploitation active
4. 2025-07-22 Added to CISA KEV
5. 2025-07-23 CISA patch deadline

Added

15 mo ago (2025-07-22)

Patch by

2025-07-23 (15 mo ago)

Ransomware

Known to be used in ransomware campaigns

Required action

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Vendor, product

Microsoft, SharePoint

CISA name

Microsoft SharePoint Improper Authentication Vulnerability

Groups reported to have exploited it in intrusions.

• Storm-2603 (Warlock) ransomware gang

reported by microsoft.comsophos.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

How it is exploited and what it leads to, in MITRE ATT&CK terms.

• T1190 Exploit Public-Facing Application exploitation
• T1505 Server Software Component primary impact
• T1059.003 Windows Command Shell secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

partial

Assessed

15 mo ago (2025-07-22)

99.06% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/http/sharepoint_toolpane_rce Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) metasploit exploit, excellent rank, 2025-07-08
• Nuclei template Microsoft SharePoint Server - Authentication Bypass nuclei detection template

• Microsoft Microsoft SharePoint Enterprise Server 2016
• Microsoft Microsoft SharePoint Server 2019
• Microsoft Microsoft SharePoint Server Subscription Edition

Weakness

• CWE-287 Improper Authentication

• msrc.microsoft.com /update-guide/vulnerability/CVE-2025-49706

  vendor-advisory, patch

• microsoft.com /en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

  vendor-advisory, press/media-coverage

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706

  government-resource, us-government-resource

• CVE List CVE-2025-49706
• NVD CVE-2025-49706

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.