CVE-2025-47166 is a critical deserialization of untrusted data vulnerability affecting Microsoft SharePoint Enterprise Server and SharePoint Server, allowing an authenticated attacker to execute arbitrary code remotely over a network. With a CVSS score of 8.8 (High), this flaw requires low privileges and no user interaction, leading to high impacts on confidentiality, integrity, and availability. While not currently in CISA's KEV catalog, its high FAUCET Risk Score of 95/100, significant community discussion, and media coverage, including a mention in a BleepingComputer article about Microsoft's June 2025 Patch Tuesday, indicate considerable attention and potential for future exploitation. Although no public Metasploit or Nuclei exploits exist, an ExploitDB entry for NTLM authentication in SharePoint 2019 suggests related research.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* | ||
< 16.0.18526.20396CPE matchmatch criteria | cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* | ||
2019CPE matchmatch criteria | cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.