CVE-2025-21348

CVE-2025-21348 is a Remote Code Execution vulnerability in Microsoft SharePoint Server. Published on 2025-01-14, it has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-285 (Improper Authorization) and NVD-CWE-noinfo.

An attacker with high privileges required (PR:H) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U).

Microsoft's Security Response Center provides mitigation guidance in their update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21348.