ToolShell — Microsoft Sharepoint Enterprise Server 2016 RCE
CVE-2025-49704
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.596 (98.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.
Affected products
- Microsoft Sharepoint Enterprise Server 2016 — versions 16.0.0
- Microsoft Sharepoint Server 2019 — versions 16.0.0
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Known ransomware campaign use: yes.
Public proof-of-concept exploits
- rapid7/metasploit-framework
- ARPSyndicate/cve-scores
- CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend
- DevGreick/devgreick
- Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell
- Salehswt/SharePoint-CVEs-Hunter
- UnHackerEnCapital/RiCharEpoint
- a-hydrae/ToolShell-Honeypot
- bitsalv/ToolShell-Honeypot
- dorkerdevil/toolshell-detection
References
- Microsoft SharePoint Remote Code Execution Vulnerability (vendor-advisory, patch)
Frequently asked questions
- What is CVE-2025-49704?
- CVE-2025-49704 is a high-severity vulnerability in Microsoft Sharepoint Enterprise Server 2016, classified under Code Injection. CVSS score: 8.8/10. Published 2025-07-08.
- How severe is CVE-2025-49704?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2025-49704 known to be exploited?
- Yes. CVE-2025-49704 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-07-22), indicating it is being actively exploited. 19 public proof-of-concept repositories are indexed.