Microsoft SharePoint CVE-2019-0604
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
|
| Impact | Critical risk (CVSS 9.8, EPSS 94.4%). SharePoint servers often contain highly sensitive corporate data and are connected to Active Directory. Compromise of SharePoint can lead to widespread data exfiltration and domain compromise. |
| Exploit ScenarioDerived | An attacker sends a crafted request exploiting the application package processing vulnerability to a SharePoint server. The server-side code execution provides access to all SharePoint content, connected databases, and potentially the ability to pivot to Active Directory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Microsoft SharePoint allows remote code execution through crafted application packages due to improper source markup validation, enabling server-side code execution on SharePoint farms without authentication.
Earlier versions of this analysis (1)
A remote code execution vulnerability in Microsoft SharePoint enables attackers to execute arbitrary code by exploiting improper validation of application package source markup.
RemediationAI
Apply Microsoft security update. Restrict network access to SharePoint. Implement WAF rules for SharePoint-specific attacks. Monitor SharePoint application pool accounts for anomalous activity.
Affected ProductsAI
Microsoft SharePoint (affected versions as specified by Microsoft)
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-20 input validation flaw allows attackers to craft application packages with malicious markup that bypasses SharePoint's validation. When the server processes the crafted package, it executes attacker-controlled code in the context of the SharePoint application pool.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
Executive ViewAI
CVE-2019-0604 presents critical security risk, a input validation vulnerability rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC