Vulnerability record · CVE-2019-0604 · published 5 March 2019
CVE-2019-0604: Microsoft SharePoint application package markup validation RCE
Microsoft · Sharepoint Enterprise Server
Microsoft SharePoint fails to validate the source markup of an application package, allowing crafted packages to execute code on the server. This is a critical, network-reachable flaw in widely deployed SharePoint versions, and it has been exploited in real attacks.
Description
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, unauthenticated network RCE, KEV listing with ransomware use, and near-maximum EPSS make this an urgent patch.
What it is
Microsoft SharePoint fails to validate the source markup of an application package, allowing crafted packages to execute code on the server. This is a critical, network-reachable flaw in widely deployed SharePoint versions, and it has been exploited in real attacks.
Impact
An unauthenticated attacker can run arbitrary code with the privileges of the SharePoint service, leading to full server compromise and potential lateral movement.
Attack surface
Reachable over the network via HTTP/HTTPS against a SharePoint endpoint; the CVSS vector shows no privileges or user interaction required.
Exploitation
Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is 0.99913 (99.967th percentile), indicating active, near-certain exploitation.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2019-0604 immediately.
- If patching cannot be completed, isolate or restrict network access to SharePoint servers.
- Enable and review SharePoint audit logging and server-side request/package activity.
- Verify no unauthorized application packages or web parts have been deployed.
- Monitor for post-exploitation activity such as new web shells or unexpected processes spawned by SharePoint.
Detection
- Hunt for suspicious application package uploads or deployments in SharePoint logs.
- Monitor IIS and SharePoint worker processes for unexpected child processes or command execution.
- Review web directories for newly written .aspx or script files.
- Correlate network requests to SharePoint with known exploitation patterns and anomalous POST bodies.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2019-0604 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Microsoft SharePoint Remote Code Execution Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/106914 | Broken LinkThird Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604 | PatchVendor Advisory |
| http://www.securityfocus.com/bid/106914 | Broken LinkThird Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604 | US Government Resource |
Track CVE-2019-0604 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-0604), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
