Microsoft Sharepoint Vulnerabilities - CVE-2025-49704 and CVE-2025-49706

Date: 07/21/2025

Severity: High

Summary

Active exploitation of Microsoft SharePoint vulnerabilities CVE-2025-49704 and CVE-2025-49706 has been observed. These flaws allow unauthenticated attackers to bypass restrictions and, when chained, can lead to arbitrary command execution on affected SharePoint Server 2016 and 2019 systems. Current attack activity includes: Deploying malicious ASPX payloads through PowerShell
Extracting machine keys for persistent access, Targeting organizations across the globe. The team urges immediate patching and adherence to Microsoft’s security guidance for these vulnerabilities. These are real-world, high-risk threats requiring urgent action.

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:

https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-07-19-Microsoft-SharePoint-vulnerabilities-CVE-2025-49704-and-49706.txt