SharePoint code injection (CVE-2025-49704) — chainable with an authentication flaw, and due the day after it was listed
A code injection vulnerability in Microsoft SharePoint. The CISA Known Exploited Vulnerabilities catalog listed it on July 22, 2025 with a remediation due date of July 23. It is described as chainable with a separate authentication vulnerability, and use in ransomware campaigns is known.
Key facts
- CVE IDCVE-2025-49704
- Affected (vendor / product)Microsoft SharePoint
- CWECWE-94
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2025-07-23 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is Microsoft SharePoint, classified as CWE-94, improper control of generation of code.
- It is described as allowing an authorized attacker to execute code over a network.
- The catalog records expressly that it could be chained with a separate authentication vulnerability.
- A separately identified vulnerability is a patch bypass for this one, with more robust protection in the later updates.
- Added July 22, 2025 with a due date of July 23; of the 1,694 entries this site holds as of 2026-09-03, only 6 carry a one-day deadline.
1The shape of code injection
Where a string supplied from outside lands in a place interpreted as part of a program, that string runs as instruction. What ought to be treated as data is treated as code. That is the class of flaw called code injection.
Here an authorized party is described as able to execute code over a network. Where arbitrary processing runs on a server, everything within that server privileges can be affected.
2Used in combination
The catalog states expressly that this could be chained with another vulnerability. Chaining matters because two flaws together reach where neither reaches alone.
- 1The firstAn authentication vulnerability, entering without the check that ought to apply
- 2The second (this one)Code injection, causing processing to run once inside
- 3The result of chainingProcessing may run on the server without passing authentication
- 4SeparatelyThe effect of each may be limited
Assessing severity one vulnerability at a time misses combinations of this kind. That the catalog records chainability is a signal that single-item assessment is not sufficient.
3What a patch bypass means
The description further notes that a separately identified vulnerability is a patch bypass for this one, and that the updates for that identifier include more robust protection. The first fix did not fully close the path, and a later update closed it again. Having applied an update does not settle the matter; which update was applied does.
4One day to remediate
The remediation deadline placed on federal agencies is usually 21 days. Here it was compressed to one. Of the entries this site holds as of 2026-09-03, only 6 carry a one-day deadline. The shortness of a deadline reads as an indicator of how widely exploitation was under way.
5What is required
The required action begins with disconnecting public-facing SharePoint Server versions that have reached end-of-life or end-of-service. Disconnection rather than updating is called for because versions no longer receiving fixes fall within scope. The hazard of leaving unsupported products exposed appears directly in what is required.
Why it matters
Assessing vulnerabilities one at a time misses paths that only open in combination. Where a later vulnerability bypasses an earlier patch, having applied an update is not itself evidence of remediation.
FAQ
What is code injection?
Why a one-day deadline?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).