Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Remote Code Execution Vulnerability.     (CVE-2025-59221, CVE-2025-59222, CVE-2025-59228, CVE-2025-59237)   
  - Information Disclosure Vulnerability     (CVE-2025-59232, CVE-2025-59235)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Remote Code Execution Vulnerability.     (CVE-2025-59221, CVE-2025-59222, CVE-2025-59228, CVE-2025-59237)   
  - Information Disclosure Vulnerability     (CVE-2025-59232, CVE-2025-59235)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Remote Code Execution Vulnerability. (CVE-2025-59228, CVE-2025-59237)   
  - Information Disclosure Vulnerability (CVE-2025-59235)

ID	Name	Product	Family	Severity
270388	Security Updates for Microsoft SharePoint Server 2019 (October 2025)	Nessus	Windows : Microsoft Bulletins	high
270383	Security Updates for Microsoft SharePoint Server 2016 (October 2025)	Nessus	Windows : Microsoft Bulletins	high
270372	Security Updates for Microsoft SharePoint Server Subscription Edition (October 2025)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2025-59237

high

Tenable Plugins

high

high

high