CVE-2025-29794: Microsoft SharePoint Remote Code Execution Vulnerability
Published Apr 8, 2025
·Updated
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Other sources
Microsoft SharePoint Remote Code Execution Vulnerability
— Microsoft
Affected Software
6 affected componentsFixes available
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Enterprise Server=2016
Microsoft SharePoint Server<16.0.18526.20172
Microsoft SharePoint Server=2019
Event History
Apr 8, 2025
CVE Published
via Microsoft·07:00 AM
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
CVE Published
via MITRE·05:23 PM
Data Sourced
via MITRE·05:23 PM
DescriptionSeverity
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-29794?
CVE-2025-29794 has a critical severity rating due to its potential for remote code execution.
2
How do I fix CVE-2025-29794?
To fix CVE-2025-29794, apply the latest patch provided by Microsoft for your SharePoint version.
3
What are the affected products of CVE-2025-29794?
CVE-2025-29794 affects Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
4
What types of attacks can CVE-2025-29794 facilitate?
CVE-2025-29794 can facilitate remote code execution by an authorized attacker, potentially compromising the system.
5
Is authentication bypass involved in CVE-2025-29794?
Yes, CVE-2025-29794 involves improper authorization, allowing an attacker to execute code without appropriate permissions.