Code Injection Vulnerability in Microsoft SharePoint (CVE‑2025‑49704) Enables Remote Code Execution
What It Is – Microsoft SharePoint contains a code‑injection flaw that allows an authenticated attacker to execute arbitrary code over the network. The issue can be chained with CVE‑2025‑49706, and a later patch‑bypass (CVE‑2025‑53770) demonstrates that the original fix was insufficient.
Exploitability – The vulnerability is exploitable by a privileged user; proof‑of‑concept code is publicly available. The CVSS vector rates it High (≈7.8).
Affected Products – Microsoft SharePoint (on‑premises and SharePoint Online) versions prior to the patches released in March 2025.
Why It Matters for Trust & Control Assurance
- Application‑security controls – The flaw highlights the need for robust code‑integrity and secure‑development controls that map to the “Secure Development” objective in the Verisq Common Framework (VCF).
- Patch‑management evidence – Continuous monitoring of patch status and retaining verifiable evidence of remediation are essential for audit readiness across NIST CSF 2.0, ISO 27001 and other frameworks.
- Defensible incident response – Knowing the exact vulnerability and having documented remediation steps reduces investigation time and supports a defensible incident‑response audit trail.
Recommended Actions
- Deploy Microsoft’s latest SharePoint security updates that address CVE‑2025‑49704 and the related bypass CVE‑2025‑53770.
- Verify that the patches are applied across all on‑premises and cloud instances; capture screenshots or automated logs as evidence.
- Update your control‑mapping repository to reflect the remediation of the “Application Security – Code Integrity” control objective.
- Enable continuous vulnerability‑scanning for SharePoint and integrate findings into your security‑posture dashboard.
Source: CISA KEV – CVE‑2025‑49704