cbcvebase.
CVE-2025-49712
published 2025-08-12

CVE-2025-49712: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
13.78%
96.1th percentile
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected

6 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < 16.0.5513.100216.0.5513.1002
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < 16.0.10417.2004116.0.10417.20041
microsoftsharepoint_server
microsoftsharepoint_server
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_server_2019

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability is exploitable by any authenticated attacker with at least Site Owner privileges on SharePoint Server via a network-based deserialization attack — monitor for unexpected code execution or process spawning from SharePoint worker processes (e.g., w3wp.exe)
  • Attack requires no elevated privileges beyond basic authentication and has low complexity — treat any anomalous SharePoint-authenticated POST requests (especially those carrying serialized .NET payloads) as high-priority alerts
  • Attack vector is network-facing and internet-exploitable with repeatable success — prioritize perimeter-level inspection of SharePoint HTTP traffic for malformed or unexpected serialized data objects
  • ·SharePoint Server 2016 and SharePoint Enterprise Server 2016 share the same KB update number — ensure both product variants are patched under the same KB to be protected

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.