Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit the vulnerability?
In a network-based attack, an authenticated attacker, who has a minimum of Site Member permissions (PR:L), could execute code remotely on the SharePoint Server.
Security updates
16.0.5504.1001 — https://support.microsoft.com/help/5002732
16.0.10417.20018 — https://support.microsoft.com/help/5002729
16.0.18526.20396 — https://support.microsoft.com/help/5002736
Vulnerabilities 1
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Revision history
-
#2
Updated acknowledgment. This is an informational change only.
-
#1
Information published.
References
-
CVE-2025-47172 Microsoft SharePoint Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47172
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss