CVE-2025-49706Vulnerability
Microsoft SharePoint Improper Authentication Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 10 months ago
CISA KEVAdded 22 Jul 2025
Fix due 23 Jul 2025
Used by ransomware: knownCISA KEV catalogue
Fix due 23 Jul 2025
Used by ransomware: knownCISA KEV catalogue
EPSS99.1%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
Velociraptor Misuse, Pt. II: The Eye of the Storm“The exploit works by first bypassing authentication (CVE-2025-49706) through a specially-crafted HTTP request to /_layouts/15/ToolPane.aspx, which contains a Referer header set to /_layouts/SignOut.aspx (which can be seen below).”
Indicators reported together
named in the same reports- hxxps://royal-boat-bf05.qgtxtebl.workers[.]dev/ssh.msiin 1 report
- royal-boat-bf05.qgtxtebl.workers[.]devin 1 report
- hxxps://royal-boat-bf05.qgtxtebl.workers[.]dev/v3.msiin 1 report
- 38.54.16[.]179in 1 report
- 91.236.230[.]76in 1 report
- chat.hcqhajfv.workers[.]devin 1 report
- hxxps://royal-boat-bf05.qgtxtebl.workers[.]dev/code.txtin 1 report
- update.githubtestbak.workers[.]devin 1 report
- c70fafe5f9a3e5a9…73aa88fd6682in 1 report
- 040d7ee5b7bb0b97…16fcacfeb423in 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2025-53770, CVE-2025-59287, CVE-2025-49704, CVE-2025-53771
Thanks — we review every report.