Microsoft SharePoint Server 特権昇格の脆弱性

Successful exploitation of CVE-2025-29976 allows an authenticated attacker to bypass security controls and gain elevated privileges within the SharePoint environment. This could enable them to access and modify sensitive data, install malicious software, or even compromise the underlying server. The impact is particularly severe in environments where SharePoint is used to manage critical business processes or store confidential information. An attacker could leverage this privilege escalation to move laterally within the network, potentially impacting other systems and data stores. The blast radius extends to any resource accessible by the SharePoint server.

Organizations heavily reliant on Microsoft SharePoint for document management, collaboration, and intranet services are at significant risk. This includes businesses with legacy SharePoint deployments or those that have not consistently applied security updates. Shared hosting environments where multiple tenants share a single SharePoint instance are also particularly vulnerable.

• windows / dotnet:

Get-WinEvent -LogName Security -Filter "EventID = 4625 -Message contains 'SharePoint'" | Where-Object {$_.Properties[0].Value -match 'Privilege Escalation'}

• windows / dotnet: Check for unusual process creations within SharePoint directories.

Get-Process | Where-Object {$_.Path -match 'SharePoint'}

• generic web: Monitor SharePoint access logs for unusual user activity or attempts to access restricted resources. • generic web: Review SharePoint configuration files for any signs of unauthorized modifications.

1. 2025-05-13Disclosure

   disclosure

1. 予約済み2025-03-12
2. 公開日2025-05-13
3. 更新日2026-02-13
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-29976 is to upgrade to Microsoft SharePoint Enterprise Server version 16.0.18526.20286 or later. If immediate patching is not feasible, consider implementing stricter access controls within SharePoint to limit the potential impact of a successful attack. Review and enforce the principle of least privilege for all SharePoint users and applications. Monitor SharePoint logs for suspicious activity, particularly privilege escalation attempts. While a direct workaround is unavailable, ensuring robust network segmentation can limit lateral movement if exploitation occurs. After upgrade, confirm successful remediation by attempting to reproduce the vulnerability with a test account and verifying that privilege escalation is prevented.