PT-2025-47642 · Microsoft · Sharepoint Online

CVE-2025-59245 · Published 2025-11-20 · Updated 2025-11-24

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Online (affected versions not specified)

Description The software contains an elevation of privilege flaw that could allow remote attackers to gain administrative control through unsafe deserialization. The flaw allows attackers to gain higher permissions within SharePoint Online. No active exploitation has been reported. The vulnerability has been patched at the platform level and no customer action is required.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-14796

CVE-2025-59245

Affected Products

Sharepoint Online

References · 13

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59245 · Security Note
• https://bdu.fstec.ru/vul/2025-14796 · Security Note
• https://t.me/cveNotify/143514 · Telegram Post
• https://twitter.com/CveFindCom/status/1991652731375792235 · Twitter Post
• https://twitter.com/SecQube/status/1992099232375849096 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1991652314487083203 · Twitter Post
• https://t.me/msrcreports/2283 · Telegram Post
• https://beyondmachines.net/event_details/microsoft-patches-critical-elevation-of-privilege-flaw-in-sharepoint-online-c-7-s-y-w/gD2P6Ple2L · Reddit Post
• https://t.me/poxek/5698 · Telegram Post
• https://twitter.com/offseq/status/1991681013320196307 · Twitter Post
• https://t.me/CVEtracker/37881 · Telegram Post
• https://twitter.com/CVEnew/status/1991640309571416333 · Twitter Post