---
id: "CVE-2019-0604"
kind: "vulnerability"
aliases: ["CVE-2019-0604"]
title: "Microsoft SharePoint: Microsoft SharePoint Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99913
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Microsoft SharePoint", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ransomware", "runtime", "self-hosted", "sharepoint", "windows"]
not_affected_if: ["patched-server", "sharepoint-online"]
published_at: "2019-03-05T23:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0604", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-0604", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0604", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Microsoft SharePoint: Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft SharePoint fails to check the source markup of an application package, so a crafted package can be used to run code. An attacker who exploits it runs code as the SharePoint application pool and the server farm account, and the flaw is on CISA's known-exploited list with a ransomware tag.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft SharePoint affected ? fixed ?

## Fix

Apply the Microsoft SharePoint updates per vendor instructions (CISA required action); the specific patched build is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0604
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-0604
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-0604

## From the sources

Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_