CVE-2025-21400

CVE-2025-21400 is a remote code execution vulnerability in Microsoft SharePoint Server caused by improper authorization (CWE-285). According to the CVSS vector, exploitation occurs over the network with low attack complexity, but requires the attacker to hold low-privileged (authenticated) credentials and involves user interaction to trigger. Successful exploitation could allow arbitrary code execution in the context of the SharePoint server, with high impact on confidentiality, integrity, and availability. Organizations running affected on-premises SharePoint Server deployments are affected; the fix shipped in Microsoft's February 2025 Patch Tuesday, which addressed 63 vulnerabilities. There is no public proof-of-concept and no confirmed in-the-wild exploitation yet, but the high EPSS score (34.5%, 98th percentile) suggests a substantial probability of exploitation within 30 days.

What to do: Apply the February 2025 security updates from Microsoft for all affected SharePoint Server versions as soon as possible, prioritizing internet-facing servers. Until patched, restrict network access to SharePoint from untrusted sources and review authentication and application logs for anomalous activity. No public PoC or in-the-wild exploitation is known, but the elevated EPSS probability warrants treating this patch cycle as high priority.