Microsoft · SharePoint
CVE-2025-49704
Microsoft SharePoint Remote Code Execution Vulnerability
这是什么
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CISA: Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
该怎么做
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
美国联邦机构的修复期限：2025年7月23日
Microsoft 的其他被利用漏洞
| 加入日期 | 漏洞 | 产品 | 严重程度 | 受攻击概率 |
|---|---|---|---|---|
| 2026年9月25日 | Code Injection | SharePoint | 高 8.8 | 8.2% |
| 2026年8月18日 | Weak Authentication | SharePoint | 严重 9.1 | 70% |
| 2026年7月22日 | Deserialization of Untrusted Data Vulnerability | SharePoint | 严重 9.8 | 3.0% |
| 2026年7月16日 | Deserialization of Untrusted Data | SharePoint | 严重 9.8 | 16% |
| 2026年3月18日 | Deserialization of Untrusted Data | SharePoint | 严重 9.8 | 29% |
| 2025年7月22日 | Improper Authentication | SharePoint | 中 6.5 | 99.1% |
| 2025年7月20日 | Deserialization of Untrusted Data | SharePoint | 严重 9.8 | >99.9% |
| 2024年10月22日 | Deserialization | SharePoint | 高 7.2 | 51% |
来源：Known Exploited Vulnerabilities（CISA，公有领域）、CVE records（cve.org）和 EPSS（FIRST）。受攻击概率是 EPSS 对未来 30 天内有人尝试利用该漏洞的估计。