Cyber Posture

CVE-2025-59245

Critical

Published: 20 November 2025

Published
20 November 2025
Modified
21 November 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0109 78.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Microsoft SharePoint Online Elevation of Privilege Vulnerability

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mandates timely remediation of the deserialization flaw in SharePoint Online through application of Microsoft patches and guidance.

SI-5 Security Alerts, Advisories, and Directives good match
prevent

Ensures receipt, dissemination, and implementation of security advisories from Microsoft's Security Response Center regarding this CVE.

SI-10 Information Input Validation partial match
prevent

Addresses CWE-502 by validating untrusted inputs before deserialization processing in SharePoint Online interactions.

Security SummaryAI

CVE-2025-59245 is an Elevation of Privilege vulnerability affecting Microsoft SharePoint Online. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-502, which involves deserialization of untrusted data. The vulnerability was published on 2025-11-20T23:15:52.253.

The vulnerability enables exploitation over the network by unauthenticated attackers with low attack complexity and no requirement for user interaction. Successful exploitation results in high impacts to confidentiality, integrity, and availability, allowing attackers to elevate privileges within the affected SharePoint Online environment.

Microsoft provides guidance on this vulnerability through its Security Response Center update guide, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59245, which details recommended mitigations and patches.

Details

CWE(s)
CWE-502

Affected Products

microsoft
sharepoint online
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

CVE-2025-59245 is an unauthenticated remote deserialization vulnerability in public-facing SharePoint Online enabling exploitation for initial access (T1190) and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References