{"schemaVersion":3,"id":"CVE-2019-0604","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft SharePoint Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.","dates":{"published":"2019-03-06T00:00:00.000Z","modified":"2025-10-21T23:45:42.715Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99913,"percentile":0.99968,"severity":"critical","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.99913},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.99913,"percentile":0.99968}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99913,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.99913,"percentile":0.99968}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft SharePoint Remote Code Execution Vulnerability","description":"Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2019-0604","label":"nvd.nist.gov/vuln/detail/CVE-2019-0604"}],"vendor":"Microsoft","product":"SharePoint","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft SharePoint Remote Code Execution Vulnerability","description":"Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2019-0604","label":"nvd.nist.gov/vuln/detail/CVE-2019-0604"}],"vendor":"Microsoft","product":"SharePoint","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"48053","name":"Microsoft SharePoint - Deserialization Remote Code Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/48053","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"windows","file":"exploits/windows/remote/48053.py","codes":["CVE-2019-0604"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"microsoft","product":"microsoft sharepoint enterprise server","name":"Microsoft SharePoint Enterprise Server","label":"microsoft sharepoint enterprise server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_enterprise_server"},{"vendor":"microsoft","product":"microsoft sharepoint foundation","name":"Microsoft SharePoint Foundation","label":"microsoft sharepoint foundation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013 Service Pack 1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013 Service Pack 1","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_foundation"},{"vendor":"microsoft","product":"microsoft sharepoint server","name":"Microsoft SharePoint Server","label":"microsoft sharepoint server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2010 Service Pack 2","noFixRecorded":false,"fixedIn":null},{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2010 Service Pack 2 | 2019","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_server"},{"vendor":"microsoft","product":"sharepoint_enterprise_server","name":"sharepoint enterprise server","label":"sharepoint_enterprise_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016","eol":null,"hubHref":"/vendor/microsoft/sharepoint_enterprise_server"},{"vendor":"microsoft","product":"sharepoint_foundation","name":"sharepoint foundation","label":"sharepoint_foundation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013:sp1","eol":null,"hubHref":"/vendor/microsoft/sharepoint_foundation"},{"vendor":"microsoft","product":"sharepoint_server","name":"SharePoint Server","label":"sharepoint_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2010:sp2","noFixRecorded":false,"fixedIn":null},{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2010:sp2 | 2019","eol":null,"hubHref":"/vendor/microsoft/sharepoint_server"}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/106914","label":"www.securityfocus.com/bid/106914","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604","hostname":"portal.msrc.microsoft.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-03-06T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft SharePoint Remote Code Execution Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:45:42.715Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T15:34:19.069Z","stale":false,"partial":false}}