Is CVE-2025-49704 (Microsoft SharePoint Code Injection) being exploited in the wild?

Yes. CISA added CVE-2025-49704 to its Known Exploited Vulnerabilities catalogue on 22 July 2025, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network.

What “being exploited in the wild” means for this SharePoint CVE

For this question, the practical answer is not just whether a flaw exists, but whether there is evidence that attackers are using it operationally. When CISA puts a CVE in the KEV catalog, it is treating the issue as a live exposure, not a theoretical weakness. That changes prioritisation immediately, especially for internet-facing SharePoint estates.

microsoft sharepoint code injection is the kind of issue that can move quickly from “patch later” to “active compromise path.” CISA Known Exploited Vulnerabilities Catalog is the right operational signal to trust first, while the CVE Program and NIST National Vulnerability Database remain useful for record verification and technical reference.

The presence of active exploitation also means the question is really about exposure management, not just vulnerability awareness. If a SharePoint server is reachable by attackers and the vulnerable code path is enabled, assume it may already be in adversarial recon or exploitation workflows. That makes visibility, patch speed, and compromise checks more important than debating severity labels in isolation.

How to confirm exposure and reduce the attack window

Start by identifying every SharePoint deployment that could be affected, including externally reachable servers, test systems that share production credentials, and legacy instances that are easy to forget. Then verify whether the vulnerable component is actually present and whether any compensating control is blocking the path attackers would use.

Prioritise the systems that are reachable from the internet or from untrusted internal segments, because those are the ones most likely to be probed first. If patching is available, treat vendor guidance as the primary source for version-specific action and use the CISA KEV entry as the trigger for emergency scheduling rather than ordinary maintenance windows.

Zero-Day and Exploited Vulnerabilities Guide is the most relevant NHIMG reference for this triage pattern, because the same response logic applies here: confirm whether the asset is exposed, compress time to remediation, and look for signs that the issue was already weaponised before you patched it.

What to do if patching must wait

If you cannot remediate immediately, move to containment rather than passive acceptance. Restrict access to SharePoint to the smallest viable user and network set, remove unnecessary internet exposure, and monitor for suspicious requests, unusual child processes, webshell indicators, or new administrative behaviour around the application host.

Do not treat mitigation as a substitute for compromise assessment. A known exploited code injection issue can be used to gain code execution, plant persistence, or stage follow-on actions long before defenders notice an obvious outage. That is why a short delay in patching should be paired with tight monitoring and an explicit exception owner.

When SharePoint has already been exposed for some time, use ToolShell SharePoint exploitation 2025 as the right mental model for post-exploitation checks: attackers may preserve access by abusing application secrets or keys, so patching alone may not end the incident.

Risk and Threat Considerations

Active exploitation raises the probability that this flaw is being used for initial access or as a bridge to broader compromise. Code injection on a collaboration platform matters because the application often sits close to sensitive documents, internal workflows, and trusted authentication paths.

Failure mechanism: An attacker reaches the vulnerable SharePoint code path, injects executable content, and uses that execution to run commands, drop tooling, or pivot deeper into the environment before the weakness is remediated.

Impact: The likely outcomes are server compromise, data exposure, lateral movement, and follow-on ransomware or extortion activity. Where the platform is widely trusted, a single compromised instance can become a launch point for broader internal access.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation demands rapid identification and remediation of exposed SharePoint assets.
Recommendation — Prioritise KEV-listed SharePoint remediation through continuous vulnerability management and exception tracking.
NIST CSF 2.0	DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events	Exploitation in the wild requires monitoring for suspicious SharePoint activity and post-compromise indicators.
Recommendation — Monitor SharePoint hosts for abnormal execution, webshell signs, and unauthorized administrative activity.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The CVE requires timely remediation of the vulnerable software flaw and validation after patching.
	SI-4 — System Monitoring	Active exploitation warrants telemetry to detect execution, persistence, and suspicious requests on SharePoint hosts.
Recommendation — Apply flaw remediation quickly and verify the SharePoint fix is deployed across all affected instances. Increase host and application monitoring on SharePoint servers during the exploitation window.
OWASP ASVS	V16 — Security Logging and Error Handling	Detection and investigation depend on logs that preserve evidence of injection and abnormal execution.
Recommendation — Ensure SharePoint and host logs retain enough detail to investigate exploitation attempts and aftermath.

Practitioner Guidance

What to prioritise: Treat any internet-facing SharePoint instance as urgent until you have confirmed patch status, reduced exposure, and checked for suspicious activity during the exploitation window. The highest value work is usually exposure inventory plus compromise hunting, not debating whether the vulnerability is “high enough” to disrupt operations.

What to verify: Confirm whether the host shows new processes, unexpected web content, modified application files, or unusual authentication and admin actions after the CISA KEV date. If the server was reachable during the active exploitation period, assume you need a post-exploitation review even if no alert fired.

Practitioner takeaway: For a KEV-listed SharePoint code injection flaw, the decision point is not whether exploitation is plausible, but whether you can prove the system was not exposed long enough to be abused.