Security CISA KEV CVE-2025-49706 CVE-2025-49706 CISA KEV
Microsoft SharePoint Improper Authentication Vulnerability
Severity unknown CVSS unknown Check the vendor advisory for fixed versions
CISA lists this Microsoft vulnerability as known exploited. Its MSRC release detail is outside this installation's collected history.
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Product SharePoint
Added to KEV 22 Jul 2025
Federal remediation due 23 Jul 2025
Known ransomware use Yes Public detection template Public Nuclei template · template membership does not establish exploit availability or applicability to your systems.
Detection template: Nuclei template listed
29 Oct 2026 Detection template: Nuclei template listed
28 Oct 2026
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this version Field-level log (12)
Up to 100 recent field edits are shown; older edits may be outside retention.
13 Nov 2026 · 12:10:20 UTC
Source coverage: public-exploit-code Incomplete → Current 13 Nov 2026 · 11:07:20 UTC
Source coverage: public-exploit-code Current → Incomplete 6 Nov 2026 · 17:32:22 UTC
Source coverage: public-exploit-code Incomplete → Current 6 Nov 2026 · 16:31:02 UTC
Source coverage: public-exploit-code Current → Incomplete 2 Nov 2026 · 17:30:39 UTC
Source coverage: public-exploit-code Incomplete → Current 2 Nov 2026 · 16:27:39 UTC
Source coverage: public-exploit-code Current → Incomplete 29 Oct 2026 · 20:19:26 UTC
Public detection template Nuclei template listed 28 Oct 2026 · 05:10:29 UTC
Public exploit code Nuclei template listed 28 Oct 2026 · 05:10:29 UTC
Source coverage: public-exploit-code Current 28 Oct 2026 · 05:10:29 UTC
Link: Nuclei template https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49706.yaml 23 Oct 2026 · 09:33:49 UTC
Source coverage: cisa-kev Incomplete → Current 23 Oct 2026 · 08:31:50 UTC
Source coverage: cisa-kev Current → Incomplete Explore global source statements, affected packages and advisory history for CVE-2025-49706 . The catalog has a separate collection scope from Microsoft release records.
More advisories, affected versions and source history
cve-program · CVE-2025-49706 Published Microsoft SharePoint Enterprise Server 2016 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Microsoft SharePoint Enterprise Server 2016",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "16.0.5508.1000",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft SharePoint Server 2019 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Microsoft SharePoint Server 2019",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "16.0.10417.20027",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft SharePoint Server Subscription Edition Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Microsoft SharePoint Server Subscription Edition",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "16.0.18526.20424",
"versionType": "custom",
"status": "affected"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON