The 6.5 that was the door.

The 6.5 was the door. The 8.8 was what walked through it. Both numbers are correct on their own terms, and triaging the patch queue by either of them in isolation produced the same outcome the post-mortems described: the door was open the day the eight-point-eight bug got patched, and the door is what the ransomware operators needed.

CVSS scores a vulnerability against itself. CVE-2025-49706 — an unauthenticated Referer-header spoof against SharePoint’s ToolPane access check — confers limited information disclosure on its own and scores accordingly. Six-point-five. Medium. The score is not wrong. The score is answering a different question than the one the patch queue is asking. The patch queue wants to know which item to do first on a Wednesday morning when an operations team has bandwidth for two of the eight items in this month’s Microsoft list. CVSS answers “which of these is the most damaging bug in isolation,” and the auth bypass loses that question every time. The bug it removes the authentication requirement from is what mass-exploitation campaigns are built out of.

This is not a SharePoint observation. ProxyShell in 2021 was three Exchange CVEs, none of them unauthenticated RCE individually, that collectively produced unauthenticated RCE. Ivanti Connect Secure in January 2024 was an 8.2 auth bypass paired with a 9.1 command injection, exploited weeks before public disclosure. Palo Alto PAN-OS in November 2024 was an auth bypass on the management interface paired with a privilege escalation, against thirteen thousand internet-exposed appliances. The pattern repeats annually. The score on the auth-bypass component lands in the Medium bucket annually. The score on the downstream code-execution component lands in High or Critical annually. The triage process that sorts by the score does the expected thing annually.

The compliance dimension is where this stops being a tooling observation and becomes an audit problem. BOD 22-01 measures whether KEV-listed vulnerabilities were remediated inside the catalog’s deadline. KEV is the corrective signal that surfaces what CVSS cannot — it is, structurally, CISA’s response to exactly the gap that CVE-2025-49706 represents. CVE-2025-49706 sat at 6.5 on the patch queue through July 8 and into the July 19 exploitation window before KEV moved it on July 22. An organization sorting by CVSS would have patched 49704 on the eighth, left 49706 for next month, and met its internal patching SLA while the chain was being walked through the access check the SLA didn’t surface.

The narrow lesson is product-specific: any SharePoint farm exposed to the internet between July 8 and July 21 needs the post-incident review that 53770 demands, because the access-bypass piece was reachable the whole time. The wider one is structural. CVSS measures the bug; KEV measures the exploitation; the patch queue still mostly sorts by CVSS. A scoring system that cannot represent compounded severity is the floor on what the triage process can see. The auth bypass is where the cost of that floor lands, year after year, on the same pattern.