CVE-2025-49704

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-49704 8.8

Microsoft · SharePoint · Added 2025-07-22 · Published 2025-07-08

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityMicrosoft SharePoint Code Injection Vulnerability

VendorMicrosoft

ProductSharePoint

Date added2025-07-22

Due date2025-07-23

CISA catalogView on CISA KEV catalog

Required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

CWECWE-94

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

NVD: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-01 14:44 UTC

Wall time0.3s

Searches4

Component defaultyes

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
https://securelist.com/toolshell-explained/117045/
https://blog.viettelcybersecurity.com/sharepoint-toolshell/
https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities
https://github.com/xcalibure2/ToolShell
https://github.com/LuemmelSec/ToolShell
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/
https://y4nush.com/posts/the-401-that-fooled-me-n-day-review-of-cve-2025-49706-in-sharepoint/

QC notes

warn component_extraction: Component 'SharePoint ToolPane web part endpoint (/_layouts/15/ToolPane.aspx) - GetPartPreviewAndPropertiesFromMarkup() method in Microsoft.SharePoint.WebPartPages.ToolPane class, exploiting ExcelDataSet control (Microsoft.PerformancePoint.Scorecards.Client.dll) deserialization via CompressedDataTable property' matches or contains product name 'SharePoint' — no specific component identified

Hunting hypothesis agent

Hunt IIS logs for POST to /_layouts/15/ToolPane.aspx?DisplayMode=Edit with Referer: /_layouts/SignOut.aspx and MSOTlPn_DWP containing ExcelDataSet CompressedDataTable, indicating ToolShell deserialization RCE.

Research details

ComponentSharePoint ToolPane web part endpoint (/_layouts/15/ToolPane.aspx) - GetPartPreviewAndPropertiesFromMarkup() method in Microsoft.SharePoint.WebPartPages.ToolPane class, exploiting ExcelDataSet control (Microsoft.PerformancePoint.Scorecards.Client.dll) deserialization via CompressedDataTable property

PreconditionsThe attacker requires network access to a vulnerable on-premises SharePoint Server (HTTP/HTTPS). Valid low-privileged SharePoint credentials are required for CVE-2025-49704 alone, though this is commonly chained with CVE-2025-49706 (authentication bypass) for unauthenticated exploitation. The target must be running SharePoint Server 2016 or 2019 with the ToolPane.aspx endpoint accessible (part of default installation). The attacker must be able to send HTTP POST requests to /_layouts/15/ToolPane.aspx (or variations) with crafted form parameters: MSOTlPn_Uri pointing to an existing .ascx file under the _controltemplates directory (e.g., AclEditor.ascx, which ships by default) and MSOTlPn_DWP containing malicious WebPart markup that instantiates the ExcelDataSet control with a crafted CompressedDataTable property. The CompressedDataTable payload is a Base64-encoded, GZip-compressed .NET binary serialized DataSet containing an ExpandedWrapper gadget chain that bypasses SharePoint's XmlValidator by nesting the dangerous type inside a List container. agent

DeliveryThe attack is delivered via a single HTTP POST request to the /_layouts/15/ToolPane.aspx endpoint (or similar path variations) with application/x-www-form-urlencoded content type. The request includes query parameters: DisplayMode=Edit and a parameter mapping to /ToolPane.aspx (e.g., foo=/ToolPane.aspx). Two form body parameters carry the exploit: MSOTlPn_Uri (set to a URL pointing to a control template file like http://sharepoint/_controltemplates/15/AclEditor.ascx) and MSOTlPn_DWP (containing malicious @Register directive and WebPart markup that instantiates Microsoft.PerformancePoint.Scorecards.ExcelDataSet with a CompressedDataTable attribute containing Base64-encoded, GZip-compressed .NET binary serialized payload). When the server processes the WebPart markup, the CompressedDataTable property getter triggers BinarySerialization.Deserialize on the decoded payload, executing the ExpandedWrapper gadget chain.

Public PoCyes

PoC URLs https://github.com/xcalibure2/ToolShell
https://github.com/LuemmelSec/ToolShell
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
https://blog.viettelcybersecurity.com/sharepoint-toolshell/
https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/
https://securelist.com/toolshell-explained/117045/ Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704

Exploit notesCVSS attack complexity: LOW. Multiple public PoCs and a Metasploit module are available, making exploitation straightforward for attackers. The vulnerability is a .NET binary deserialization flaw (similar to CVE-2020-1147) using the ExpandedWrapper gadget chain. However, the attacker must construct a valid Base64/GZip-encoded binary serialized payload, which introduces moderate technical complexity. Public exploit tools automate this process fully. The original July 8 patch was incomplete (only marked ExcelDataSet as unsafe without auto-applying) and was bypassed (CVE-2025-53770).

SummaryCVE-2025-49704 is a code injection/deserialization vulnerability in Microsoft SharePoint Server's ToolPane web part component. An attacker with low-privileged access (or chained with the authentication bypass CVE-2025-49706) can achieve remote code execution by sending a crafted HTTP POST request to the /_layouts/15/ToolPane.aspx endpoint, where the MSOTlPn_DWP parameter triggers deserialization of an ExpandedWrapper gadget chain via the ExcelDataSet control's CompressedDataTable property. This vulnerability affects SharePoint Server 2016 and 2019, is under active exploitation as part of the 'ToolShell' attack chain by multiple threat actors including nation-state groups, and has multiple public PoCs available.

Tia coverage

First reported2026-10-01

First exploit report2026-10-02

Exploit report → KEV437 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.