CVE-2025-49712: Microsoft SharePoint Server RCE Vulnerability

CVE-2025-49712 Overview

CVE-2025-49712 is a deserialization of untrusted data vulnerability [CWE-502] affecting Microsoft Office SharePoint Server. An authenticated attacker can send crafted serialized data over the network to trigger arbitrary code execution in the SharePoint worker process. The flaw impacts SharePoint Server 2016 and SharePoint Server 2019 and carries a CVSS 3.1 base score of 8.8. Successful exploitation grants the attacker the privileges of the SharePoint application pool identity, enabling lateral movement, data theft, and persistence within collaboration environments. Microsoft published the advisory on August 12, 2025.

Critical Impact

Authenticated attackers can execute arbitrary code on SharePoint servers across the network, compromising confidentiality, integrity, and availability of hosted content and downstream systems.

Affected Products

• Microsoft SharePoint Server 2016 (Enterprise)
• Microsoft SharePoint Server 2019
• Microsoft Office SharePoint deployments using vulnerable serialization handlers

Discovery Timeline

• 2025-08-12 - CVE-2025-49712 published to NVD
• 2025-08-15 - Last updated in NVD database

Technical Details for CVE-2025-49712

Vulnerability Analysis

The vulnerability resides in SharePoint Server's handling of serialized .NET objects received over the network. SharePoint deserializes attacker-supplied data without sufficient type validation, allowing gadget chains to execute arbitrary code during object reconstruction. An attacker authenticated to SharePoint with low privileges can submit crafted payloads to endpoints that invoke vulnerable deserializers. Code executes in the context of the SharePoint application pool account, typically with permissions to read site content, modify configuration, and reach back-end SQL databases. The EPSS data reflects elevated real-world exploitation likelihood for this class of SharePoint deserialization flaw, consistent with prior weaponization of similar bugs.

Root Cause

The root cause is unsafe deserialization of untrusted input [CWE-502]. SharePoint accepts serialized objects from authenticated callers and reconstructs them using formatters that do not enforce a strict allow-list of permitted types. Dangerous gadget types within loaded assemblies can be instantiated during deserialization, triggering side effects that yield code execution.

Attack Vector

Exploitation occurs over the network against SharePoint web endpoints. The attacker must hold valid SharePoint credentials but does not require administrative rights. No user interaction is needed. The attacker submits a serialized payload containing a deserialization gadget chain. When SharePoint processes the payload, the gadget chain runs operating system commands or loads attacker-controlled assemblies inside the w3wp.exe worker process hosting the SharePoint application pool.

No verified public proof-of-concept code is available for this CVE. Refer to the Microsoft Security Advisory for vendor-specific technical details.

Detection Methods for CVE-2025-49712

Indicators of Compromise

• Unexpected child processes spawned by w3wp.exe running the SharePoint application pool, such as cmd.exe, powershell.exe, or rundll32.exe.
• New or modified ASPX, ASHX, or DLL files written to SharePoint web application directories under %ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\.
• Outbound network connections from SharePoint servers to untrusted hosts shortly after authenticated POST requests to SharePoint endpoints.

Detection Strategies

• Inspect IIS logs for authenticated POST requests carrying large or Base64-encoded bodies to SharePoint handlers, correlated with anomalous process creation.
• Hunt for .NET deserialization gadget signatures such as System.Windows.Data.ObjectDataProvider, TypeConfuseDelegate, or ActivitySurrogateSelector in request payloads and memory.
• Alert on SharePoint worker processes loading unsigned or newly created assemblies from temporary ASP.NET compilation directories.

Monitoring Recommendations

• Enable Windows command-line and PowerShell script-block logging on all SharePoint servers and forward events to a central analytics platform.
• Monitor SharePoint authentication logs for accounts that suddenly issue high-volume API calls or access uncommon endpoints.
• Track file integrity on SharePoint farm binaries, layouts directories, and the global assembly cache to detect unauthorized changes.

How to Mitigate CVE-2025-49712

Immediate Actions Required

• Apply the August 2025 Microsoft SharePoint security updates referenced in the Microsoft Security Advisory on all SharePoint 2016 and 2019 servers.
• Audit and rotate credentials for any account that authenticated to SharePoint during the exposure window, prioritizing service and farm accounts.
• Restrict SharePoint web front-end exposure to the public internet and require VPN or zero-trust network access where feasible.

Patch Information

Microsoft addressed CVE-2025-49712 in the August 2025 security update cycle for SharePoint Server 2016 and SharePoint Server 2019. Administrators should install the cumulative update package corresponding to their farm version, then run the SharePoint Products Configuration Wizard or PSConfig.exe on every server in the farm to complete the upgrade. Confirm the build number post-installation against the version specified in the Microsoft advisory.

Workarounds

• Enforce least-privilege on SharePoint application pool accounts so that successful exploitation does not yield domain or SQL administrative rights.
• Block or filter unauthenticated and untrusted traffic to SharePoint endpoints at a reverse proxy or web application firewall pending patch deployment.
• Disable unused SharePoint service applications and custom solutions that expose additional deserialization surfaces.

# Verify SharePoint farm build after patching
Get-SPFarm | Select-Object BuildVersion

# Run configuration wizard on each server in the farm
& "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\16\BIN\PSConfig.exe" -cmd upgrade -inplace b2b -wait -force