CVE-2025-49706

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

First PoC 2025-07-20
267 days →KEV 2026-04-14
49 days →Metasploit 2026-06-02
137 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2025-07-22 · due 2025-07-23 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 99%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

3 known · links only

GitHub PoCs · by trust, then stars1

AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation ↗Trust ok 100
A deep dive into CVE-2025-49706 — the SharePoint spoofing flaw now exploited in the wild for stealthy web shell deployment and privilege escalation.
★ 18 · created 2025-07-20

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) ↗
This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704, and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path. As this exploit module
ruby · seen 2026-10-18

Nuclei1

Microsoft SharePoint Server - Authentication Bypass ↗
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

Storm-2603
1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
APT31
1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
APT27
1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals