Microsoft SharePoint Remote Code Execution Vulnerability

cisa required action Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

1. 2025-07-08 First public exploit (Metasploit exploit/windows/http/sharepoint_toolpane_rce)
2. 2025-07-08 Published
3. 2025-07-22 Added to CISA KEV
4. 2025-07-22 CISA SSVC: exploitation active
5. 2025-07-23 CISA patch deadline

Added

last yr. (2025-07-22)

Patch by

2025-07-23 (last yr.)

Ransomware

Known to be used in ransomware campaigns

Required action

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Vendor, product

Microsoft, SharePoint

CISA name

Microsoft SharePoint Code Injection Vulnerability

Groups reported to have exploited it in intrusions.

• Storm-2603 (Warlock) ransomware gang

reported by microsoft.comsophos.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

How it is exploited and what it leads to, in MITRE ATT&CK terms.

• T1190 Exploit Public-Facing Application exploitation
• T1059.003 Windows Command Shell primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

last yr. (2025-07-22)

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

• Metasploit exploit/windows/http/sharepoint_toolpane_rce Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) metasploit exploit, excellent rank, 2025-07-08

• Microsoft Microsoft SharePoint Enterprise Server 2016
• Microsoft Microsoft SharePoint Server 2019

Weakness

• CWE-94 Improper Control of Generation of Code

• msrc.microsoft.com /update-guide/vulnerability/CVE-2025-49704

  vendor-advisory, patch

• microsoft.com /en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

  vendor-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704

  government-resource, us-government-resource

• CVE List CVE-2025-49704
• NVD CVE-2025-49704

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.