ToolShell — Microsoft Sharepoint Enterprise Server 2016 Auth bypass
CVE-2025-49706
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Vulnerability class: Broken Authentication
EPSS: 0.750 (98.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C.
Affected products
- Microsoft Sharepoint Enterprise Server 2016 — versions 16.0.0
- Microsoft Sharepoint Server 2019 — versions 16.0.0
- Microsoft Sharepoint Server Subscription Edition — versions 16.0.0
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Known ransomware campaign use: yes.
Public proof-of-concept exploits
- AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation
- rapid7/metasploit-framework
- AdityaBhatt3010/CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE
- CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend
- DevGreick/devgreick
- Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell
- Salehswt/SharePoint-CVEs-Hunter
- UnHackerEnCapital/RiCharEpoint
- a-hydrae/ToolShell-Honeypot
- bitsalv/ToolShell-Honeypot
References
- Microsoft SharePoint Server Spoofing Vulnerability (vendor-advisory, patch)
Frequently asked questions
- What is CVE-2025-49706?
- CVE-2025-49706 is a medium-severity vulnerability in Microsoft Sharepoint Enterprise Server 2016, classified under Improper Authentication. CVSS score: 6.5/10. Published 2025-07-08.
- How severe is CVE-2025-49706?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2025-49706 known to be exploited?
- Yes. CVE-2025-49706 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-07-22), indicating it is being actively exploited. 25 public proof-of-concept repositories are indexed.