What to know about ToolShell, the SharePoint threat under mass exploitation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-49704+1 related CVE | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 group max | 100% | KEVRansomware | KEV |
From the original article
1 min read at arstechnica.com
Microsoft fixed the vulnerability pair—CVE-2025-49706 and CVE-2025-49704— two weeks ago as part of the company’s monthly update release. As the world learned over the weekend, the patches were incomplete, a lapse that opened organizations around the world to the new attacks. Q: What sorts of malicious things are attackers doing with these newer ToolShell exploits?
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.