ExploitPublished 2 Jul 2025

Microsoft SharePoint 2019 · NTLM Authentication

Source Exploit-DB RSS Feed

Severity

Medium

Rated by Threat Radar

Data as of 23 Jul 2025, 01:53 UTC

What to do

AI-suggested

European organizations should take specific steps beyond generic advice to mitigate this threat: 1) Audit SharePoint 2019 environments to identify if NTLM authentication is enabled and assess the necessity of its use. 2) Where possible, disable NTLM authentication in favor of more secure protocols such as Kerberos or modern OAuth-based authentication. 3) Apply the latest Microsoft security updates and patches for SharePoint 2019, even if no direct patch is listed, as cumulative updates may address related issues. 4) Implement network-level protections such as SMB signing and enforce strict firewall rules to limit exposure of SharePoint servers to untrusted networks. 5) Monitor authentication logs for unusual NTLM authentication attempts or relay attack patterns. 6) Employ multi-factor authentication (MFA) for SharePoint access to reduce the risk of credential misuse. 7) Educate IT staff on the risks associated with legacy authentication protocols and encourage migration planning to more secure authentication methods.

Description

Microsoft SharePoint 2019 - NTLM Authentication

Impact

For European organizations, the exploitation of NTLM authentication weaknesses in SharePoint 2019 can have significant consequences. SharePoint is widely used across Europe in both public and private sectors for collaboration, document management, and intranet services. Unauthorized access through NTLM exploitation could lead to exposure of sensitive corporate or governmental data, disruption of business processes, and potential compliance violations under regulations such as GDPR. The medium severity suggests that while the threat is serious, it may not lead to immediate full system compromise but could serve as a foothold for further lateral movement or privilege escalation within networks. Organizations relying heavily on SharePoint 2019 with NTLM enabled are at increased risk, especially if other mitigations like network segmentation or multi-factor authentication are not in place.

Indicators of compromise

Exploit source code

Exploit code for Microsoft SharePoint 2019 - NTLM Authentication1,922 characters

# Titles: Microsoft SharePoint 2019 NTLM Authentication
# Author: nu11secur1ty
# Date: 06/27/25
# Vendor: Microsoft
# Software: https://www.microsoft.com/en-us/download/details.aspx?id=57462
# Reference:
https://www.networkdatapedia.com/post/ntlm-autSharePoint 2019 NTLM Authentication hentication-security-risks-and-how-to-avoid-them-gilad-david-maayan

## Description:
Microsoft SharePoint Central Administration improperly exposes
NTLM-authenticated endpoints to low-privileged or even brute-force…

References

Community reviews

Loading reviews…