CVE-2025-49704

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

KEV 2026-04-14
49 days →First PoC 2026-06-02
same day →Metasploit 2026-06-02
137 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2025-07-22 · due 2025-07-23 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

1 known · links only

Metasploit1

Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) ↗
This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704, and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path. As this exploit module
ruby · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

Storm-2603
1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
APT31
1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
APT27
1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals

Exploits

Metasploit1

On the wire

Watch this one?