Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Continued exploitation has been observed for a series of SharePoint vulnerabilities dubbed "ToolShell" including recent reports of further ransomware deployment.

Microsoft reports that Storm-2603 is exploiting these flaws to deploy the Warlock ransomware. Patching is strongly advised.

Microsoft has confirmed exploitation of these flaws by Chinese threat actors and warns of continued exploitation going forward. Organizations are advised to patch quickly.

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Server Spoofing Vulnerability. (CVE-2025-49706) 

  - Remote Code Execution Vulnerabilites.
    (CVE-2025-49701, CVE-2025-49703, CVE-2025-49704)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Server Spoofing Vulnerability. (CVE-2025-49706)     
  - Remote Code Execution Vulnerabilites.
    (CVE-2025-49701, CVE-2025-49703, CVE-2025-49704)

ID	Name	Product	Family	Type	Severity
241554	Security Updates for Microsoft SharePoint Server 2019 (July 2025)	Nessus	Windows : Microsoft Bulletins	Local	high
241541	Security Updates for Microsoft SharePoint Server 2016 (July 2025)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2025-49704

high

Tenable Plugins

high

high