CISA Warns of Microsoft SharePoint Code Injection and Authentication Vulnerability Exploited in Wild
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
CISA has issued an urgent warning regarding two critical Microsoft SharePoint vulnerabilities that threat actors are actively exploiting in the wild.\u00a0<\/p>\n
The vulnerabilities, designated as CVE-2025-49704<\/a> and CVE-2025-49706, pose significant risks to organizations running on-premises SharePoint servers and have been added to CISA\u2019s Known Exploited Vulnerabilities (KEV) catalog with an immediate remediation deadline.<\/p>\n CVE-2025-49704 represents a severe code injection vulnerability in Microsoft SharePoint that falls under the CWE-94 classification for Improper Control of Generation of Code.\u00a0<\/p>\n This flaw allows authorized attackers to execute arbitrary code over a network connection, potentially giving them complete control over the affected SharePoint server.\u00a0<\/p>\n The vulnerability enables threat actors to inject malicious code into the SharePoint application, which can then be executed with the privileges of the SharePoint service account, leading to potential system compromise and data exfiltration.<\/p>\n CVE-2025-49706<\/a> is an improper authentication vulnerability classified under CWE-287 (Improper Authentication) that affects Microsoft SharePoint\u2019s authentication mechanisms.\u00a0<\/p>\n This security flaw allows authorized attackers to perform spoofing attacks over a network, enabling them to impersonate legitimate users and bypass authentication controls.\u00a0<\/p>\n Successful exploitation of this vulnerability grants attackers unauthorized access to view sensitive information and make modifications to disclosed data, effectively compromising the integrity and confidentiality of SharePoint environments.<\/p>\n When the two vulnerabilities are chained together, they combine to form a powerful attack vector.\u00a0\u00a0<\/p>\n Threat actors typically leverage CVE-2025-49706 first to bypass authentication<\/a> mechanisms through spoofing techniques, then exploit CVE-2025-49704 to inject and execute malicious code on the compromised server.\u00a0<\/p>\n Microsoft has confirmed that the update for CVE-2025-53770 includes more robust protections than the individual patches for these vulnerabilities, suggesting a comprehensive security enhancement approach that addresses the underlying architectural weaknesses.<\/p>\nKey Takeaways<\/mark><\/strong>
1. CVE-2025-49704 and CVE-2025-49706 are being actively exploited to compromise SharePoint servers.
2.\u00a0 CISA requires immediate remediation by July 23, 2025.
3. Disconnect old SharePoint systems, patch current versions immediately.<\/pre>\nCode Injection Vulnerability (CVE-2025-49704)<\/strong><\/h2>\n
Improper Authentication Vulnerability (CVE-2025-49706)<\/strong><\/h2>\n