CVE-2025-29976
published 2025-05-13CVE-2025-29976: Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.
PriorityP343high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.47%
38.3th percentile
Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5500.1001 | 16.0.5500.1001 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10417.20010 | 16.0.10417.20010 |
| microsoft | microsoft_sharepoint_server_subscription_edition | >= 16.0.0 < 16.0.18526.20286 | 16.0.18526.20286 |
| microsoft | sharepoint_server | < 16.0.18526.20286 | 16.0.18526.20286 |
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c86v-xr5g-xjhx: Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally
ghsa_unreviewed·2025-05-13
CVE-2025-29976 [HIGH] CWE-269 GHSA-c86v-xr5g-xjhx: Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally
Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.
Microsoft
Microsoft SharePoint Server Elevation of Privilege Vulnerability
vendor_msrc·2025-05-13·CVSS 7.8
CVE-2025-29976 [HIGH] CWE-269 Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Description: Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited the vulnerability could elevate privileges and gain the ability to read the load file.
FAQ: I am running SharePoint Enterprise Server 2016 or SharePoint Server 2019 and there are multiple updates available for each of these affected versions. Do I need to install all the updates listed in the Security Updates table for these versions?
Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, th
No detection rules found.
No public exploits indexed.
Qualys
Microsoft and Adobe Patch Tuesday, May 2025 Security Update Review
blogs_qualys·2025-05-13
Microsoft and Adobe Patch Tuesday, May 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for May 2025
Adobe Patches for May 2025
Zero-day Vulnerabilities Patched in May Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in May Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Audit
Qualys Monthly Webinar Series
Microsoft’s May 2025 Patch Tuesday rolls out critical security updates, addressing multiple vulnerabilities across Windows, Office, and other key products. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for May 2025
In this month’s Patch Tuesday, Ma
Qualys
Microsoft and Adobe Patch Tuesday, May 2025 Security Update Review | Qualys
blogs_qualys·2025-05-13
Microsoft and Adobe Patch Tuesday, May 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for May 2025
- Adobe Patches for May 2025
- Zero-day Vulnerabilities Patched in May Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in May Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Audit
- Qualys Monthly Webinar Series
Microsoft’s May 2025 Patch Tuesday rolls out critical security updates, addressing multiple vulnerabilities across Windows, Office, and other key products. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for May 2025
In this month’s Patc
Talos
Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-05-13·CVSS 8.8
CVE-2025-30397 [HIGH] Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for May of 2025 which includes 78 vulnerabilities affecting a range of products, including 11 that Microsoft marked as “critical”.
Microsoft noted five vulnerabilities that have been observed to be exploited in the wild. CVE-2025-30397 is a remote code execution vulnerability in the Microsoft Scripting Engine. There were also four elevation of privilege vulnerabilities being actively exploited, CVE-2025-32709, CVE-2025-30400, CVE-2025-32701 and CVE-2025-32706 affecting the Ancillary Function Driver for WinSock, the DWM Core Library and the Windows Common Log File System Driver.
The eleven "critical” entries consist of five remote code execution (RCE) vulnerabilities, four elevation of privilege vulnerabilities, one information disclosure
Talos
Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-05-13·CVSS 8.8
CVE-2025-30397 [HIGH] Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for May of 2025 which includes 78 vulnerabilities affecting a range of products, including 11 that Microsoft marked as “critical”.
Microsoft noted five vulnerabilities that have been observed to be exploited in the wild. CVE-2025-30397 is a remote code execution vulnerability in the Microsoft Scripting Engine. There were also four elevation of privilege vulnerabilities being actively exploited, CVE-2025-32709 , CVE-2025-30400 , CVE-2025-32701 and CVE-2025-32706 affecting the Ancillary Function Driver for WinSock, the DWM Core Library and the Windows Common Log File System Driver.
The eleven "critical” entries consist of five remote code execution (RCE) v
Bleepingcomputer
Microsoft May 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws
blogs_bleepingcomputer·2025-05-13·CVSS 7.8
[HIGH] Microsoft May 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws
## Microsoft May 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws
## Lawrence Abrams
Today is Microsoft's May 2025 Patch Tuesday, which includes security updates for 72 flaws, including five actively exploited and two publicly disclosed zero-day vulnerabilities.
This Patch Tuesday also fixes six "Critical" vulnerabilities, five being remote code execution vulnerabilities and another an information disclosure bug.
The number of bugs in each vulnerability category is listed below:
17 Elevation of Privilege Vulnerabilities
2 Security Feature Bypass Vulnerabilities
28 Remote Code Execution Vulnerabilities
15 Information Disclosure Vulnerabilities
7 Denial of Service Vulnerabilities
2 Spoofing Vulnerabilities
This count does not include Azure, Dataverse, Mariner, and Microsof
2025-05-13
Published