Loading story…
Microsoft published security advisories for CVE-2025-49704 and CVE-2025-49701, identifying both flaws as Microsoft SharePoint Remote Code Execution vulnerabilities. The entries were added to the Microsoft Security Update Guide, indicating that SharePoint deployments are affected by vulnerabilities that could allow code execution on targeted systems.
The advisories provide formal tracking for two separate SharePoint RCE issues and signal that organizations running Microsoft SharePoint should review the associated update guidance and remediation information for both CVEs. The dual disclosure highlights concurrent risk in a widely used enterprise collaboration platform and raises the urgency for defenders to assess exposure across SharePoint environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft added Security Update Guide entries for CVE-2025-49701 and CVE-2025-49704, both identified as Microsoft SharePoint Remote Code Execution vulnerabilities. The references indicate public disclosure of these vulnerabilities through Microsoft's advisory system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting **Exchange Server** and **SharePoint Server**, including Exchange flaws tracked as `CVE-2023-21706`, `CVE-2023-28310`, and `CVE-2023-36439`, alongside SharePoint issues `CVE-2026-33110`, `CVE-2026-33112`, and `CVE-2026-40368`. The SharePoint vulnerabilities were tied to **deserialization of untrusted data** and were rated **Important**, with CVSS scores of **8.8** for `CVE-2026-33110` and `CVE-2026-33112`, and **8.0** for `CVE-2026-40368`. Microsoft said `CVE-2026-33110` could let an authenticated attacker with at least **Site Member** permissions execute code remotely on a vulnerable SharePoint Server, while `CVE-2026-33112` required at least **Site Owner** privileges to inject and run arbitrary code. For `CVE-2026-40368`, exploitation involved a client connecting to a malicious server, potentially leading to code execution on the client. Microsoft reported that the SharePoint flaws were **not publicly disclosed** and **not exploited in the wild** at publication, assessed exploitation as less likely, and released fixes, including a shared KB update for **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**.
Jun 29, 2026
Microsoft disclosed and patched **CVE-2026-58644**, a critical remote code execution flaw in **Microsoft SharePoint** caused by insecure deserialization of untrusted data (`CWE-502`). The vulnerability carries a **CVSS 9.8** rating and allows an **unauthorized attacker** to execute arbitrary code over the network by sending a crafted HTTP request, with **no user interaction required**. Affected products include **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** prior to patched versions published through Microsoft's security guidance. Reporting on the release said no active exploitation had been confirmed at disclosure, but warned that exploitation is likely because SharePoint is widely deployed in enterprises; organizations were urged to prioritize patching internet-exposed SharePoint systems, review access permissions, and monitor server logs for suspicious activity.
Jul 17, 2026Microsoft published security advisories for several remote code execution vulnerabilities affecting **SharePoint**, **Microsoft Edge (Chromium-based)**, **Azure Orbital Spatio**, **Azure Virtual Network Gateway**, and **Microsoft Power Pages**, including `CVE-2026-45659`, `CVE-2026-45495`, `CVE-2026-40412`, `CVE-2026-40411`, and `CVE-2026-23652`. The most detailed disclosures focused on SharePoint Server, where Microsoft described `CVE-2026-35439` and `CVE-2026-40357` as **deserialization of untrusted data** flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers. Microsoft rated both SharePoint issues **Important** with **CVSS 8.8** and said exploitation requires valid access, with `CVE-2026-35439` requiring at least **Site Owner** privileges and `CVE-2026-40357` requiring **Site Member** permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**. Microsoft also disclosed `CVE-2026-40362`, an **Excel** heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.
Jun 29, 2026