Critical
KEV + Ransomware
CVE-2025-49704
Longlegs Group Exploits Microsoft SharePoint Server Flaws to Deploy Warlock Ransomware
Vendor / product: Microsoft SharePoint Server
Event date: 2025-07-19
Public PoC: Yes
First tracked by RiskWire: 2026-10-02
CISA KEV catalog
Added to KEV
Federal remediation due
2025-07-23 (436 days overdue)
Ransomware campaign use
Known
CISA description
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Required action
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Named threat actors
LonglegsStorm-2603CL-CRI-1040CamoFeiChamelGang
Sources & citations (4)
- Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators cybersecuritynews.com · 2026-10-01
- Warlock-Ransomware: 40 Hosts in zwei Stunden infiziert, 33 verschlüsselt ad-hoc-news.de · 2026-10-01
- Warlock Campaign Adds Kernel-Level Defense Suppression ground.news · 2026-10-01
- Warlock Attackers Abuse Vulnerable Driver to Disable Security Tools Before Ransomware Deployment cyberpress.org · 2026-10-01
References
See CVE-2025-49704 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →