CVE-2025-49704: Microsoft SharePoint Code Injection Vulnerability

What CISA requires

Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Forensic triage

No

What to do now

1. Find every instance of SharePoint you run, including the forgotten ones, and check its version against the vendor advisory.
2. Apply the vendor's fix or mitigation, before July 23, 2025 if you are bound by CISA's deadline, sooner if it faces the internet.
3. Assume it was tried against you already: look for signs of exploitation from the date it was added, not from the day you patched.
4. Until every instance is patched, block the attack at the edge: a WAF in blocking mode stops PHP and Node.js code injection payloads.

References

• https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
• https://nvd.nist.gov/vuln/detail/CVE-2025-49704

CVE-2025-49704 in the National Vulnerability Database