CVE-2019-0604: Microsoft SharePoint Remote Code Execution Vulnerability
Vulnerability summary
CVE-2019-0604 is a critical (CVSS 9.8) Improper Input Validation vulnerability in Microsoft SharePoint. It is known to be exploited: CISA lists it, first on 03-11-2021. It has been used in ransomware campaigns. EPSS estimates a 99.91% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 06-03-2019PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVMicrosoft SharePoint Remote Code Execution Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
99.91%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.91% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-0604
Public exploits
1 foundMicrosoft SharePoint - Deserialization Remote Code Execution
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Microsoft6 products
- microsoft sharepoint enterprise server2016
- microsoft sharepoint foundation2013 Service Pack 1
- microsoft sharepoint server2010 Service Pack 2 | 2019
- sharepoint_enterprise_server2016
- sharepoint_foundation2013:sp1
1 vendor · 6 products
References
3 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604X Refsource CONFIRMPatchVendor Advisory- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604Government ResourceUS Government Resource