Microsoft · SharePoint
Microsoft SharePoint contains an improper authentication flaw in its Office SharePoint component. An unauthorized attacker with network access can perform spoofing against it without authentication or user interaction.
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
First seen exploited 10 days after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This improper authentication vulnerability in Microsoft SharePoint allows an attacker to send unauthenticated HTTP POST requests to the endpoint, which SharePoint will trust the request if constructed correctly. This gives the attacker access to the APIs despite the lack of credentials, as well as the ability to impersonate users and abuse native functionality.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2025-49706 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
After some digging, we learned that three days earlier, the offensive security team from Code White GmbH demonstrated they could reproduce an unauthenticated RCE exploit chain in SharePoint, a combination of two bugs presented at Pwn2Own Berlin earlier this year in May: CVE-2025-49706 & CVE-2025-49704.
3 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.