CVE-2019-0604

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 99.91%
EPSS Percentile: 99.97%
CISA KEV: YES — Known Exploited Vulnerability

Description

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 06-Mar-2019 06:29
Last Modified: 17-Jun-2026 09:08
EPSS Date: 2026-11-08
CWE: CWE-20

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2021-11-03
Remediation Due: 2022-05-03
Known Ransomware Campaign Use: Known
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-0604

CNA Products / Version Status

Microsoft · Microsoft SharePoint Enterprise Server Source: CNA · [email protected]
Default status: unknown

2016 — affected
Microsoft · Microsoft SharePoint Foundation Source: CNA · [email protected]
Default status: unknown

2013 Service Pack 1 — affected
Microsoft · Microsoft SharePoint Server Source: CNA · [email protected]
Default status: unknown

2010 Service Pack 2 — affected
2019 — affected

Affected Products / Versions

microsoft / sharepoint_enterprise_server Source: NVD CPE · affected
Version / affected range: 2016
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
microsoft / sharepoint_foundation Source: NVD CPE · affected
Version / affected range: 2013
cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
microsoft / sharepoint_server Source: NVD CPE · affected
Version / affected range: 2010
cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*
microsoft / sharepoint_server Source: NVD CPE · affected
Version / affected range: 2019
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

References

Last enrichment sync: 09-Nov-2026 05:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Application – Initial foothold via exploits against internet-facing apps such as SharePoint (CVE-2019-0604) (‘frequently establishes the initial foothold… through vulnerabilities such as CVE-2019-0604 in Handala Profile Details MOIS Links, Wiper Campaigns and Tradecraft

Malware (7)

People (3)

Threat Actors (10)

MITRE ATT&CK (11)

Vendors (2)

Products (5)

Tools (3)

Industries (7)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.