CVE•Published 2025-07-08•1 article on news•6 live references•NVD data

CVE-2025-49706

Vulnerability data via CVEDB (Shodan)

CISA action: Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.

CVSS v3.1

6.5

MEDIUM

EPSS percentile

100

Exploit Prediction Scoring System · top 0% of all CVEs

Description

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Timeline

Published 2025-07-08

External references

NVD MITRE Exploit-DB Sploitus trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag4 hosts

vuln:CVE-2025-49706

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product + version

product:"Microsoft Sharepoint Enterprise Server" version:"2016"

Version-pinned fingerprint from NVD's first vulnerable CPE.

Shodan · banner/body mention

http.html:"Sharepoint Enterprise Server"

HTTP body or banner mentions "Sharepoint Enterprise Server" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2025-49706