CVE coverage
View on NVD →
CVE-2025-49704
CVSS 8.8
Actively exploited (KEV)
3 detections found
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Unusual Web Config File Access | production | 2026-09-18 |
| sigma | Suspicious File Write to SharePoint Layouts Directory | experimental | 2025-07-24 |
| sigma | Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create | experimental | 2025-07-24 |