CVE-2025-29794 Details
Description
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
A remote code execution vulnerability has been identified in Microsoft Office SharePoint. This issue arises from improper authorization, allowing an authenticated attacker to execute arbitrary code over the network. The vulnerability affects multiple SharePoint versions, including SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
Security updates are available for all affected SharePoint versions. Users should install the latest security update for their SharePoint version to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29794 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| microsoft sharepoint enterprise server | 2016 |
CPE
Remediation
| |
| microsoft sharepoint server | < 16.0.18526.20172 2019 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2025 | Initial Analysis | [email protected] |
| Apr 8, 2025 | New CVE Received | [email protected] |