Critical SharePoint Vulnerability Triggers Immediate Patch Request Due to Emerging RCE Threat
Cybersecurity experts are urging organisations to take immediate action following the disclosure of a critical vulnerability in Microsoft SharePoint, identified as CVE-2025-49712, in the latest Patch Tuesday security update. This vulnerability poses a significant threat as it has the potential to facilitate remote code execution (RCE) when combined with other known flaws. Saeed Abbasi, Senior Manager of Security Research at Qualys Threat Research Unit, highlighted the urgency of the situation, especially in light of last month’s “ToolShell” zero-day attacks. He noted that while this RCE requires authentication, it dangerously pairs with known authentication bypasses, allowing attackers to potentially achieve full server compromise and data exfiltration. Abbasi emphasised the importance of prioritising and patching all SharePoint updates, rotating keys, and eliminating internet exposure to mitigate risks. He warned that delaying these efforts could lead to regulatory scrutiny and significant data breaches, stating, “SharePoint’s exploit streak isn’t over.”
The August Patch Tuesday update from Microsoft addressed a total of 107 Common Vulnerabilities and Exposures (CVEs), with 13 rated as critical and 91 as important. Elevation of privilege (EoP) vulnerabilities accounted for 39.3% of the fixes, while remote code execution issues made up 32.7%, reflecting trends observed in previous months. Satnam Narang, Senior Staff Research Engineer at Tenable, noted an upward trend in post-compromise vulnerabilities over code execution bugs, with EoP vulnerabilities representing the bulk of CVEs patched this month. He referred to the patch for CVE-2025-53779, a privilege escalation flaw known as BadSuccessor, which has limited immediate impact due to specific prerequisites for exploitation. Narang also pointed out that Microsoft patched two more SharePoint vulnerabilities this month, including CVE-2025-49712 and CVE-2025-53760, raising concerns following the chaos from the ToolShell vulnerabilities. Since 2022, Microsoft has averaged 21.7 SharePoint vulnerabilities patched annually, with 2023 already seeing a high of 25.
Categories: Cybersecurity Vulnerabilities, Remote Code Execution, Patch Management
Tags: Cybersecurity, Vulnerability, Microsoft, SharePoint, Remote Code Execution, Authentication Bypass, Data Breaches, Patch Tuesday, Exploitation, Security Posture