CVE-2025-49704
KEV の『悪用』には未遂(脆弱でない環境やハニーポットでの試行)が含まれ、特定の組織が侵害されたことを意味しない。
KEV の登録内容
- vulnerabilityName
- Microsoft SharePoint Code Injection Vulnerability
- vendorProject
- Microsoft
- product
- SharePoint
- dateAdded
- 2025-07-22
- shortDescription
- Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
- requiredAction
- Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
- dueDate
- 2025-07-23
- knownRansomwareCampaignUse
- Known
- forensicTriage
- No
- notes
- CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49704
- cwes
- CWE-94
観測した変更
取り込み開始以降、KEV の値の変更は観測していません。
CVE レコード(CVE Program)
CVE レコードはまだ取り込んでいません(CVE Program に未公開の場合は CVE 未公開)。
外部のページ
出典: CISA Known Exploited Vulnerabilities Catalog(CISA KEV。CC0 1.0)。 詳しくは出典表記とライセンス。
出典: CVE Program(CVE レコード)。詳しくは出典表記とライセンス。
Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.