Skip to content
Hermes Codex

CVE-2025-49704: Remote Code Injection in Microsoft SharePoint Server

HERMES

HERMES THREAT SCORE & COLLABORATION INJECTION RISK

Target: Microsoft SharePoint Enterprise Server 2016 / 2019 / Subscription Edition
Confidence: 98%
92 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 19 / 20
Threat Activity 19 / 20
Weaponization 19 / 20
Exposure 18 / 20
Prevalence 19 / 20
Impact 19 / 20
Exploit Maturity 19 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2025-49704 at an HTS of 92 (CRITICAL). While assigned low privileges (PR:L) by the vendor, operational attack chains combining this vulnerability with authentication spoofing CVE-2025-49706 yield unauthenticated remote code execution under the IIS worker pool context.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-49704: Remote Code Injection in Microsoft SharePoint ServerVULNERABILITY

Connected Nodes: 2
Active Relationships (Outgoing)
→ affectsPRODUCTMicrosoft Windows & Windows Server
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:
→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter
90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

1. Identification

Section titled “1. Identification”
ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2025-49704Official MITRE / NVD entry
Associated CWECWE-94: Code InjectionUnfiltered dynamic code generation and execution
CVSS v3.1 Score8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Score8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Applicable CPEscpe:2.3:a:microsoft:sharepoint_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*		On-premises SharePoint deployments
Affected Versions2016 (< 16.0.5513.1001), 2019 (< 16.0.10417.20037), SE (< 16.0.18526.20508)All unpatched on-premises farms
Fixed Versions16.0.5513.1001, 16.0.10417.20037, 16.0.18526.20508July 2025 security updates

2. Exploitation

Section titled “2. Exploitation”
  • CISA KEV: Added on July 22, 2025; confirmed active ransomware campaign utilization (KnownRansomwareCampaignUse = Known).
  • EPSS Score: 0.99995 (Percentile: 99.995%).
  • Operational Status: Confirmed in-the-wild exploitation. Used by advanced threat actors as an execution primitive following initial authentication bypass.
  • PoC & Weaponization: Public proof-of-concept exploits and chained script toolkits exist within offensive research channels.
  • Access Conditions: Requires low user privileges (PR:L), but operates without authentication when chained with spoofing vulnerability CVE-2025-49706.

3. Threat Intelligence

Section titled “3. Threat Intelligence”
  • Threat Groups:
    • Linen Typhoon: Cyber espionage targeting defense and strategic contractors.
    • Violet Typhoon: Exfiltration of diplomatic and high-education research repositories.
  • Timeline: Initial unauthorized exploitation detected on July 7, 2025, operating concurrently with initial probing for CVE-2025-53770.

4. Detection and Forensics

Section titled “4. Detection and Forensics”

Sigma Rule

Section titled “Sigma Rule”
title: SharePoint Code Injection Compiler Spawn (CVE-2025-49704)
id: 49704-sharepoint-code-injection-en
status: production
description: Detects unexpected compilation and shell execution originating from w3wp.exe SharePoint worker processes.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\csc.exe'
      - '\cvtres.exe'
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection_parent and selection_child
fields:
  - ParentCommandLine
  - CommandLine
  - User
level: high

Forensic Artifacts & ATT&CK

Section titled “Forensic Artifacts & ATT&CK”
  • Event ID 4688 / Sysmon 1: Monitor unexpected csc.exe executions with temporary assembly files in %WINDIR%\Microsoft.NET\Framework64\...\Temporary ASP.NET Files\.
  • MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1059.005 (Command and Scripting Interpreter: .NET), T1068 (Exploitation for Privilege Escalation).

5. Remediation and Hardening

Section titled “5. Remediation and Hardening”
  1. Apply Security Updates: Install July 2025 cumulative security updates on all SharePoint farm nodes.
  2. Server Reboot Required: A reboot of all hosts is mandatory to ensure all assemblies and runtime modules reload cleanly.
  3. AMSI Integration: Verify that Antimalware Scan Interface (AMSI) integration is enabled to scan dynamic code in memory.

6. Enterprise Exploitation Scenario

Section titled “6. Enterprise Exploitation Scenario”

« What happens if this vulnerability is exploited in an enterprise? »

Section titled “« What happens if this vulnerability is exploited in an enterprise? »”
  1. Perimeter Infiltration: An adversary leveraging compromised low-privilege user credentials (or bypassing authentication via CVE-2025-49706) submits a crafted payload that injects dynamic C# directives into the SharePoint page parser.
  2. Arbitrary Code Execution: The ASP.NET runtime compiles and executes the injected code with the privileges of the SharePoint service account.
  3. Unrestricted Database Extraction: The attacker directly accesses the underlying SQL databases, exfiltrating sensitive corporate files, financial tables, and internal communication archives without generating typical file download web telemetry.
  4. Persistent Implant Deployment: The attacker installs a malicious .NET HTTP module within IIS, retaining permanent backdoor access across system restarts.