KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-49706
6.5
PoC Available
KEV
Active Exploitation
Details
VulnerabilityMicrosoft SharePoint Improper Authentication Vulnerability
VendorMicrosoft
ProductSharePoint
Date added2025-07-22
Due date2025-07-23
CISA catalogView on CISA KEV catalog
Required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
CWECWE-287
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Descriptions
KEV: Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
NVD: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Compliance SSVC + BOD 26-04
Automatableno
Technical impactpartial
Exploitation statusactive
3-day qualifyingNo
Public timeline14 days
Non-public timeline14 days
Forensic (public)Not required
Forensic (non-public)Not required
Research metadata
Last researched2026-09-01 15:40 UTC
Wall time0.4s
Searches4
Component defaultyes
Sources
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706
https://securelist.com/toolshell-explained/117045/
https://blog.viettelcybersecurity.com/sharepoint-toolshell/
https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities
https://github.com/xcalibure2/ToolShell
https://github.com/LuemmelSec/ToolShell
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/
https://y4nush.com/posts/the-401-that-fooled-me-n-day-review-of-cve-2025-49706-in-sharepoint/
https://securelist.com/toolshell-explained/117045/
https://blog.viettelcybersecurity.com/sharepoint-toolshell/
https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities
https://github.com/xcalibure2/ToolShell
https://github.com/LuemmelSec/ToolShell
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/
https://y4nush.com/posts/the-401-that-fooled-me-n-day-review-of-cve-2025-49706-in-sharepoint/
QC notes
warn component_extraction: Component 'SharePoint SPRequestModule.PostAuthenticateRequestHandler() method in Microsoft.SharePoint.ApplicationRuntime.SPRequestModule class (Microsoft.SharePoint.dll) - HTTP request authentication pipeline for ToolPane.aspx and other protected endpoints' matches or contains product name 'SharePoint' — no specific component identified
Hunting hypothesis agent
Hunt IIS access logs for unauthenticated POST requests to /_layouts/15/ToolPane.aspx with Referer header set to /_layouts/SignOut.aspx and DisplayMode=Edit query parameter, indicating auth bypass exploitation.
Research details
ComponentSharePoint SPRequestModule.PostAuthenticateRequestHandler() method in Microsoft.SharePoint.ApplicationRuntime.SPRequestModule class (Microsoft.SharePoint.dll) - HTTP request authentication pipeline for ToolPane.aspx and other protected endpoints
PreconditionsThe attacker requires network access to a vulnerable on-premises SharePoint Server (HTTP/HTTPS reachable). No authentication credentials are needed as this is an unauthenticated authentication bypass. The target must be running SharePoint Server 2016, 2019, or Subscription Edition (on-premises) with IIS configured in integrated mode (the default). The ToolPane.aspx endpoint must be accessible (part of default SharePoint installation). The attacker must craft an HTTP request with: (1) the Referer HTTP header set to /_layouts/SignOut.aspx (or /_layouts/14/SignOut.aspx or /_layouts/15/SignOut.aspx, case-insensitive), (2) the request path ending with ToolPane.aspx (the original vulnerability) or ToolPane.aspx/ (the bypass), (3) query parameter DisplayMode=Edit, and (4) a query parameter mapping to /ToolPane.aspx (e.g., foo=/ToolPane.aspx) to satisfy the InCustomToolPane check. Additional form parameters MSOTlPn_Uri and MSOTlPn_DWP may be required to reach the vulnerable deserialization sink when chained with CVE-2025-49704. agent
DeliveryThe attack is delivered via a single crafted HTTP request (typically POST) to a protected SharePoint endpoint, most commonly /_layouts/15/ToolPane.aspx?DisplayMode=Edit&foo=/ToolPane.aspx. The critical element is the Referer HTTP header set to /_layouts/SignOut.aspx (case-insensitive). SharePoint's SPRequestModule.PostAuthenticateRequestHandler method processes the request before authentication is fully established. A logic bug in this method sets authentication bypass flags (flag6=false, flag7=true) when the Referer header matches a sign-out page path, causing the subsequent authentication check to be skipped. The request does not require any session cookies, authorization tokens, or other credentials. In the patch bypass (CVE-2025-53771), appending a trailing slash to ToolPane.aspx (making it ToolPane.aspx/) defeats the July 8 patch's string-ending check.
Public PoCyes
PoC URLs
https://github.com/xcalibure2/ToolShell
https://github.com/LuemmelSec/ToolShell
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
https://blog.viettelcybersecurity.com/sharepoint-toolshell/
https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/
https://securelist.com/toolshell-explained/117045/ Third-party repos; verify before use.
https://github.com/LuemmelSec/ToolShell
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb
https://blog.viettelcybersecurity.com/sharepoint-toolshell/
https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/
https://securelist.com/toolshell-explained/117045/ Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW. Exploitation is trivially simple once the technique is known: the attacker merely sets the Referer HTTP header to /_layouts/SignOut.aspx. Public PoCs and Metasploit module are available. The original July 8 patch (which checked if the request path ends with ToolPane.aspx) was bypassed by appending a trailing slash (ToolPane.aspx/), leading to CVE-2025-53771. The fix was subsequently improved with a strict allowlist of permitted endpoints when signed-out referrer is used.
SummaryCVE-2025-49706 is an improper authentication vulnerability in Microsoft SharePoint Server's HTTP request processing pipeline (SPRequestModule.PostAuthenticateRequestHandler). An unauthenticated attacker can bypass SharePoint's authentication checks by sending a crafted HTTP request with the Referer header set to /_layouts/SignOut.aspx, which tricks the server into treating the request as authenticated. This vulnerability affects SharePoint Server 2016, 2019, and Subscription Edition, is under active exploitation as part of the 'ToolShell' attack chain, and has multiple public PoCs and automated exploit tools available. The July 8 patch was easily bypassed (CVE-2025-53771) by appending a trailing slash to ToolPane.aspx.
Tia coverage
First reported2026-10-01
First exploit report2026-10-02
Exploit report → KEV437 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.