EXPOSURES › CVE-2025-49706
CVE-2025-49706
CRITICAL ⌖ ON CISA KEV · EXPLOITEDMicrosoft SharePoint's improper authentication flaw allowed attackers to spoof network requests, view sensitive data, and modify information.
This improper authentication vulnerability in Microsoft SharePoint enabled attackers to perform network spoofing, leading to unauthorized viewing and modification of sensitive data. DIB organizations must ensure SharePoint is patched immediately, as this flaw was actively exploited in the wild and linked to ransomware campaigns. Failure to patch exposes organizations to data breaches and compliance violations under NIST 800-171 and CMMC requirements.
Shame score — The vulnerability was actively exploited in the wild, linked to ransomware, and allowed attackers to spoof network requests to view and modify sensitive data, indicating a severe and avoidable security failure.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |