{"schema":"vulnpedia.research/1","cve":"CVE-2025-49706","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706","tags":["vendor-advisory","patch","Vendor Advisory"],"source":"mitre","sourceId":"microsoft","modified":"2026-02-13T19:07:42.100Z","origins":[{"source":"mitre","sourceId":"microsoft","modified":"2026-02-13T19:07:42.100Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706"},{"source":"nvd","sourceId":"CVE-2025-49706","modified":"2026-08-04T05:16:34.723","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706"}]},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","tags":["vendor-advisory","Press/Media Coverage","Vendor Advisory","KEV report"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-04T03:55:53.894Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-04T03:55:53.894Z","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"},{"source":"nvd","sourceId":"CVE-2025-49706","modified":"2026-08-04T05:16:34.723","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-04T03:55:53.894Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-04T03:55:53.894Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706"},{"source":"nvd","sourceId":"CVE-2025-49706","modified":"2026-08-04T05:16:34.723","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706"}]},{"source":"euvd","sourceId":"EUVD-2025-20552","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-20552","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2025-20552","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-20552"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://research.eye.security/sharepoint-under-siege/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://research.eye.security/sharepoint-under-siege/"}]},{"url":"https://x.com/Unit42_Intel/status/1946654044316905883","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://x.com/Unit42_Intel/status/1946654044316905883"}]},{"url":"https://infosecwriteups.com/cve-2025-49706-sharepoint-spoofing-vulnerability-under-active-exploitation-3a640df68d3e","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://infosecwriteups.com/cve-2025-49706-sharepoint-spoofing-vulnerability-under-active-exploitation-3a640df68d3e"}]},{"url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"}]},{"url":"https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/"}]},{"url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day"}]},{"url":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.fortiguard.com/threat-signal-report/6159/microsoft-sharepoint-zero-day","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.fortiguard.com/threat-signal-report/6159/microsoft-sharepoint-zero-day"}]},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/in-the-wild-exploitation-of-cve-2025-53770-and-cve-2025-53771-technical-details-and-mitigation-strategies/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/in-the-wild-exploitation-of-cve-2025-53770-and-cve-2025-53771-technical-details-and-mitigation-strategies/"}]},{"url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"}]},{"url":"https://www.fortinet.com/blog/threat-research/inside-the-toolshell-campaign","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.fortinet.com/blog/threat-research/inside-the-toolshell-campaign"}]},{"url":"https://www.splunk.com/en_us/blog/security/sharepoint-exploits-and-the-hidden-threat-of-iis-module-persistence.html","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.splunk.com/en_us/blog/security/sharepoint-exploits-and-the-hidden-threat-of-iis-module-persistence.html"}]},{"url":"https://mp.weixin.qq.com/s/h6_ijQAHhq4tersaBE5fXQ","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://mp.weixin.qq.com/s/h6_ijQAHhq4tersaBE5fXQ"}]},{"url":"https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/"}]},{"url":"https://falconfeeds.io/blogs/echoes-of-the-exploit-old-vulnerabilities-threat-actor-campaigns","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://falconfeeds.io/blogs/echoes-of-the-exploit-old-vulnerabilities-threat-actor-campaigns"}]},{"url":"https://www.blackfog.com/warlock-ransomware-blackfog-in-action/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.blackfog.com/warlock-ransomware-blackfog-in-action/"}]},{"url":"https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/"}]},{"url":"https://www.bleepingcomputer.com/news/security/the-heat-wasnt-just-outside-cyber-attacks-spiked-in-summer-2025/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.bleepingcomputer.com/news/security/the-heat-wasnt-just-outside-cyber-attacks-spiked-in-summer-2025/"}]},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/echoes-in-the-shell-legacy-tooling-behind-ongoing-sharepoint-toolshell-exploitation/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/echoes-in-the-shell-legacy-tooling-behind-ongoing-sharepoint-toolshell-exploitation/"}]},{"url":"https://www.cisa.gov/news-events/analysis-reports/ar25-218a","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-218a"}]},{"url":"https://www.cisa.gov/sites/default/files/2025-08/MAR-251132.c1.v1.CLEAR_.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/2025-08/MAR-251132.c1.v1.CLEAR_.pdf"}]},{"url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf"}]},{"url":"https://cyble.com/blog/ransomware-groups-july-2025-attacks/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://cyble.com/blog/ransomware-groups-july-2025-attacks/"}]},{"url":"https://www.attackiq.com/2025/08/27/emulating-warlock-ransomware/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.attackiq.com/2025/08/27/emulating-warlock-ransomware/"}]},{"url":"https://news.sophos.com/en-us/2025/09/17/gold-salems-warlock-operation-joins-busy-ransomware-landscape/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://news.sophos.com/en-us/2025/09/17/gold-salems-warlock-operation-joins-busy-ransomware-landscape/"}]},{"url":"https://www.sophos.com/en-us/blog/gold-salems-warlock-operation-joins-busy-ransomware-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.sophos.com/en-us/blog/gold-salems-warlock-operation-joins-busy-ransomware-landscape"}]},{"url":"https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/storm-2603-targeting-sharepoint-vulnerabilities-and-critical-infrastructure-worldwide","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/storm-2603-targeting-sharepoint-vulnerabilities-and-critical-infrastructure-worldwide"}]},{"url":"https://www.microsoft.com/en-us/security/blog/2025/09/24/retail-at-risk-how-one-alert-uncovered-a-persistent-cyberthreat/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.microsoft.com/en-us/security/blog/2025/09/24/retail-at-risk-how-one-alert-uncovered-a-persistent-cyberthreat/"}]},{"url":"https://blog.talosintelligence.com/ir-trends-q3-2025/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/"}]},{"url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report"}]},{"url":"https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf"}]},{"url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/"}]},{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/"}]},{"url":"https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm"}]},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-49706"}]},{"url":"https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/"}]},{"url":"https://blog.polyswarm.io/polyswarms-2025-year-in-review","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://blog.polyswarm.io/polyswarms-2025-year-in-review"}]},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025"}]},{"url":"https://medium.com/@nshcthreatrecon/vulnerability-exploitation-landscape-2025-trends-and-2026-outlook-6e375cfc8861","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://medium.com/@nshcthreatrecon/vulnerability-exploitation-landscape-2025-trends-and-2026-outlook-6e375cfc8861"}]},{"url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026"}]},{"url":"https://b9866c47-b467-4bc0-b154-6afa06da0ab5.usrfiles.com/ugd/b9866c_2578eb8c8ffe4257b30efef3ad0f953e.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://b9866c47-b467-4bc0-b154-6afa06da0ab5.usrfiles.com/ugd/b9866c_2578eb8c8ffe4257b30efef3ad0f953e.pdf"}]},{"url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf"}]},{"url":"https://slcyber.io/whitepapers-reports/the-ransomware-landscape-in-h2-2025","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://slcyber.io/whitepapers-reports/the-ransomware-landscape-in-h2-2025"}]},{"url":"https://resources.dataminr.com/runtime/content/tev0mnMKQzuJTxST","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://resources.dataminr.com/runtime/content/tev0mnMKQzuJTxST"}]},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report"}]},{"url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025"}]},{"url":"https://medium.com/@nshcthreatrecon/2025-global-cyber-threat-landscape-dd0da508b433","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://medium.com/@nshcthreatrecon/2025-global-cyber-threat-landscape-dd0da508b433"}]},{"url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf"}]},{"url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa"}]},{"url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf"}]},{"url":"https://www.rapid7.com/blog/post/tr-accelerating-attack-cycle-2026-global-threat-landscape-report/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.rapid7.com/blog/post/tr-accelerating-attack-cycle-2026-global-threat-landscape-report/"}]},{"url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf"}]},{"url":"https://www.fortinet.com/resources/reports/threat-landscape-report","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.fortinet.com/resources/reports/threat-landscape-report"}]},{"url":"https://www.fortinet.com/library/soc-dgt/global-threat-landscape-report","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.fortinet.com/library/soc-dgt/global-threat-landscape-report"}]},{"url":"https://www.tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation"}]},{"url":"https://medium.com/s2wblog/ransomware-landscape-in-h1-2026-statistics-and-key-issues-f15683e233cd","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://medium.com/s2wblog/ransomware-landscape-in-h1-2026-statistics-and-key-issues-f15683e233cd"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-22&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-22&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-26&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-26&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/2026-Microsoft-Digital-Defense-Report.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/2026-Microsoft-Digital-Defense-Report.pdf"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-22&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-22&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-23&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-23&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-24&host_type=src&vulnerability=cve-2025-49706","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-24&host_type=src&vulnerability=cve-2025-49706"}]},{"url":"https://vulncheck.com/xdb/7778878554f4","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"7778878554f4","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"7778878554f4","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/7778878554f4"}]},{"url":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"7778878554f4","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"7778878554f4","modified":"2025-07-18T00:00:00Z","url":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation","source":"poc-in-github","sourceId":"CVE-2025-49706","description":"A deep dive into CVE-2025-49706 — the SharePoint spoofing flaw now exploited in the wild for stealthy web shell deployment and privilege escalation.","modified":"2026-10-13T19:08:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-49706","url":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation"},{"source":"poc-in-github","sourceId":"CVE-2025-49706","modified":"2026-10-13T19:08:18Z","url":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation"}],"tags":[]}],"cataloguedPoc":[{"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb","source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","description":"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)","modified":"2026-06-02 10:32:30 +0000","kind":"metasploit","verification":"catalogued","origins":[{"source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"},{"source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","modified":"2026-06-02 10:32:30 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"}],"tags":[]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"7778878554f4","url":"https://vulncheck.com/xdb/7778878554f4","cve":"CVE-2025-49706","dateAdded":"2025-07-20T18:49:11Z","modified":"2025-07-18T00:00:00Z","exploitType":"remote-with-credentials","repositoryUrl":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation","observations":[{"dateAdded":"2025-07-20T18:49:11Z","exploitType":"remote-with-credentials"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"7778878554f4","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/7778878554f4"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2025-07-18T00:00:00Z","modified":"2025-07-18T00:00:00Z","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","knownRansomwareCampaignUse":"Known","reportedByVulncheckCanaries":false,"vendorProject":"Microsoft","product":"SharePoint","dueDate":"2025-07-23T00:00:00Z","cisaDateAdded":"2025-07-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://research.eye.security/sharepoint-under-siege/","dateAdded":"2025-07-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://research.eye.security/sharepoint-under-siege/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://x.com/Unit42_Intel/status/1946654044316905883","dateAdded":"2025-07-19T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://x.com/Unit42_Intel/status/1946654044316905883"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://infosecwriteups.com/cve-2025-49706-sharepoint-spoofing-vulnerability-under-active-exploitation-3a640df68d3e","dateAdded":"2025-07-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://infosecwriteups.com/cve-2025-49706-sharepoint-spoofing-vulnerability-under-active-exploitation-3a640df68d3e"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/","dateAdded":"2025-07-21T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day","dateAdded":"2025-07-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://fortiguard.fortinet.com/outbreak-alert/microsoft-sharepoint-zero-day"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.fortiguard.com/threat-signal-report/6159/microsoft-sharepoint-zero-day"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/in-the-wild-exploitation-of-cve-2025-53770-and-cve-2025-53771-technical-details-and-mitigation-strategies/","dateAdded":"2025-07-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/in-the-wild-exploitation-of-cve-2025-53770-and-cve-2025-53771-technical-details-and-mitigation-strategies/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/","dateAdded":"2025-07-24T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.fortinet.com/blog/threat-research/inside-the-toolshell-campaign","dateAdded":"2025-07-25T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.fortinet.com/blog/threat-research/inside-the-toolshell-campaign"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.splunk.com/en_us/blog/security/sharepoint-exploits-and-the-hidden-threat-of-iis-module-persistence.html"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://mp.weixin.qq.com/s/h6_ijQAHhq4tersaBE5fXQ","dateAdded":"2025-07-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://mp.weixin.qq.com/s/h6_ijQAHhq4tersaBE5fXQ"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/","dateAdded":"2025-07-31T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://falconfeeds.io/blogs/echoes-of-the-exploit-old-vulnerabilities-threat-actor-campaigns","dateAdded":"2025-08-04T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://falconfeeds.io/blogs/echoes-of-the-exploit-old-vulnerabilities-threat-actor-campaigns"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.blackfog.com/warlock-ransomware-blackfog-in-action/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/","dateAdded":"2025-08-05T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.bleepingcomputer.com/news/security/the-heat-wasnt-just-outside-cyber-attacks-spiked-in-summer-2025/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/echoes-in-the-shell-legacy-tooling-behind-ongoing-sharepoint-toolshell-exploitation/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-218a","dateAdded":"2025-08-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-218a"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.cisa.gov/sites/default/files/2025-08/MAR-251132.c1.v1.CLEAR_.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","dateAdded":"2025-08-12T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://cyble.com/blog/ransomware-groups-july-2025-attacks/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.attackiq.com/2025/08/27/emulating-warlock-ransomware/","dateAdded":"2025-08-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.attackiq.com/2025/08/27/emulating-warlock-ransomware/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://news.sophos.com/en-us/2025/09/17/gold-salems-warlock-operation-joins-busy-ransomware-landscape/","dateAdded":"2025-09-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://news.sophos.com/en-us/2025/09/17/gold-salems-warlock-operation-joins-busy-ransomware-landscape/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.sophos.com/en-us/blog/gold-salems-warlock-operation-joins-busy-ransomware-landscape"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/storm-2603-targeting-sharepoint-vulnerabilities-and-critical-infrastructure-worldwide"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.microsoft.com/en-us/security/blog/2025/09/24/retail-at-risk-how-one-alert-uncovered-a-persistent-cyberthreat/","dateAdded":"2025-09-24T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.microsoft.com/en-us/security/blog/2025/09/24/retail-at-risk-how-one-alert-uncovered-a-persistent-cyberthreat/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/","dateAdded":"2025-10-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report","dateAdded":"2025-10-29T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf","dateAdded":"2025-11-12T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/","dateAdded":"2025-12-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/","dateAdded":"2025-12-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-49706","dateAdded":"2025-12-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-49706"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.polyswarm.io/polyswarms-2025-year-in-review","dateAdded":"2026-01-05T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://blog.polyswarm.io/polyswarms-2025-year-in-review"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","dateAdded":"2026-01-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@nshcthreatrecon/vulnerability-exploitation-landscape-2025-trends-and-2026-outlook-6e375cfc8861","dateAdded":"2026-01-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://medium.com/@nshcthreatrecon/vulnerability-exploitation-landscape-2025-trends-and-2026-outlook-6e375cfc8861"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026","dateAdded":"2026-01-28T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://b9866c47-b467-4bc0-b154-6afa06da0ab5.usrfiles.com/ugd/b9866c_2578eb8c8ffe4257b30efef3ad0f953e.pdf","dateAdded":"2026-02-12T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://b9866c47-b467-4bc0-b154-6afa06da0ab5.usrfiles.com/ugd/b9866c_2578eb8c8ffe4257b30efef3ad0f953e.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf","dateAdded":"2026-02-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://slcyber.io/whitepapers-reports/the-ransomware-landscape-in-h2-2025"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://resources.dataminr.com/runtime/content/tev0mnMKQzuJTxST","dateAdded":"2026-02-19T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://resources.dataminr.com/runtime/content/tev0mnMKQzuJTxST"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","dateAdded":"2026-02-25T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025","dateAdded":"2026-03-05T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@nshcthreatrecon/2025-global-cyber-threat-landscape-dd0da508b433","dateAdded":"2026-03-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://medium.com/@nshcthreatrecon/2025-global-cyber-threat-landscape-dd0da508b433"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf","dateAdded":"2026-03-09T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa","dateAdded":"2026-03-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf","dateAdded":"2026-03-13T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.rapid7.com/blog/post/tr-accelerating-attack-cycle-2026-global-threat-landscape-report/","dateAdded":"2026-03-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.rapid7.com/blog/post/tr-accelerating-attack-cycle-2026-global-threat-landscape-report/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf","dateAdded":"2026-03-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.fortinet.com/resources/reports/threat-landscape-report","dateAdded":"2026-05-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.fortinet.com/resources/reports/threat-landscape-report"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.fortinet.com/library/soc-dgt/global-threat-landscape-report","dateAdded":"2026-05-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.fortinet.com/library/soc-dgt/global-threat-landscape-report"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://www.tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation","dateAdded":"2026-07-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/s2wblog/ransomware-landscape-in-h1-2026-statistics-and-key-issues-f15683e233cd","dateAdded":"2026-09-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://medium.com/s2wblog/ransomware-landscape-in-h1-2026-statistics-and-key-issues-f15683e233cd"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-22&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-09-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-22&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-26&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-09-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-26&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-09-27T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-09-28T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-09-29T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-09-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/2026-Microsoft-Digital-Defense-Report.pdf","dateAdded":"2026-10-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/2026-Microsoft-Digital-Defense-Report.pdf"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2025-49706"},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-10-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-10-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure","dateAdded":"2026-10-09T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-22&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-10-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-22&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-23&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-10-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-23&host_type=src&vulnerability=cve-2025-49706"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","catalog":"VulnCheck KEV","kind":"report","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-24&host_type=src&vulnerability=cve-2025-49706","dateAdded":"2026-10-24T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-49706","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-24&host_type=src&vulnerability=cve-2025-49706"}]}]}