{"id":"CVE-2019-0604","kind":"vulnerability","aliases":["CVE-2019-0604"],"related":[],"title":"Microsoft SharePoint: Microsoft SharePoint Remote Code Execution Vulnerability","description":"Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft SharePoint fails to check the source markup of an application package, so a crafted package can be used to run code. An attacker who exploits it runs code as the SharePoint application pool and the server farm account, and the flaw is on CISA's known-exploited list with a ransomware tag.","severity":"critical","cvss":9.8,"epss":0.99913,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft SharePoint","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ransomware","runtime","self-hosted","sharepoint","windows"],"not_affected_if":["patched-server","sharepoint-online"],"how_to_check":null,"fix":"Apply the Microsoft SharePoint updates per vendor instructions (CISA required action); the specific patched build is unknown from the sources.","status":"open","published_at":"2019-03-05T23:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:37+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T21:41:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft SharePoint updates per vendor instructions (CISA required action); the specific patched build is unknown from the sources.","reach":"unknown","impact":"high","summary":"Microsoft SharePoint fails to check the source markup of an application package, so a crafted package can be used to run code. An attacker who exploits it runs code as the SharePoint application pool and the server farm account, and the flaw is on CISA's known-exploited list with a ransomware tag.","category":"runtime","who_cares":["sharepoint","windows","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Code runs as SharePoint app pool and farm account on the server.","analyst_note":"Find the affected build range and patch KB from the Microsoft advisory for CVE-2019-0604 and confirm the exploit prerequisites (auth, reachability) to fill how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["sharepoint-online","patched-server"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000484,"input_tokens":2859,"output_tokens":397,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected build range and patch KB from the Microsoft advisory for CVE-2019-0604 and confirm the exploit prerequisites (auth, reachability) to fill how_to_check and fix.","search":"'-0604':11A,14A '-2019':10A,13A 'account':63B,115C 'action':118C 'appli':119C 'applic':35B,57B,89C,108C 'attack':48B,92C 'check':29B,83C 'cisa':69B,116C 'code':6A,46B,53B,101C 'context':104C 'could':98C 'craft':39B 'cve':9A,12A 'execut':7A 'exploit':17B,50B,73B,95C 'fail':27B,81C 'farm':62B,114C 'flaw':66B 'host':22B 'instruct':123C 'known':72B 'known-exploit':71B 'list':74B 'markup':32B,86C 'microsoft':1A,3A,15A,25B,79C 'packag':36B,40B,90C 'per':121C 'pool':58B,109C 'ransomwar':18B,77B 'remot':5A,100C 'requir':117C 'run':45B,52B,99C 'runtim':19B 'self':21B 'self-host':20B 'server':61B,113C 'sharepoint':2A,4A,16A,23B,26B,56B,80C,107C,112C 'sourc':31B,85C 'success':94C 'tag':78B 'updat':120C 'use':43B 'vendor':122C 'vulner':8A,97C 'window':24B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-03-05T23:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-0604","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0604","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2019-0604","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0604","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-0604","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0604","severity":null,"published_at":"2019-03-05T23:29:00+00:00","modified_at":"2026-06-17T02:08:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}