CVE-2025-21400

CVE-2025-21400 is a Remote Code Execution vulnerability affecting Microsoft SharePoint Server. Published on 2025-02-11, it carries a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-285 as well as NVD-CWE-noinfo.

An attacker with low privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction. Successful exploitation enables remote code execution, resulting in high impacts to confidentiality, integrity, and availability without scope change.

Microsoft has published an advisory with mitigation guidance in their update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21400.