{"id":"CVE-2019-0604","published":"2019-03-05T23:29:00Z","modified":"2026-06-17T02:08:31Z","title":"Microsoft SharePoint Remote Code Execution Vulnerability","vendor":"Microsoft","product":"SharePoint","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.","provenance":"source","from":"NVD"},"summary":{"text":"A remote code execution flaw in Microsoft SharePoint arises because the software fails to properly check the source markup of an application package. An attacker who can reach the affected SharePoint service over the network, without needing credentials or any user interaction, can exploit this to run code on the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:10:51Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99913,"percentile":0.99967,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0604","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-05-10","exploitedFirstSeen":"2019-05-10","ransomware":true,"evidence":[{"url":"https://threatpost.com/fin7-active-exploits-sharepoint/144628/","date":"2019-05-10"},{"url":"https://www.ict-nn.com/fin7-linked-to-escalating-active-exploits-for-microsoft-sharepoint-bug/","date":"2019-05-13"},{"url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/","date":"2019-05-28"},{"url":"https://securelist.com/apt-trends-report-q2-2019/91897/","date":"2019-08-01"},{"url":"https://blog.sonicwall.com/en-us/2019/12/top-cves-exploited-in-the-wild-in-the-year-2019/","date":"2019-12-27"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-133a","date":"2020-05-12"},{"url":"https://www.trendmicro.com/en_us/research/21/d/hello-ransomware-uses-updated-china-chopper-web-shell-sharepoint-vulnerability.html","date":"2021-04-27"},{"url":"https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-espionage-campaign-in-israel.html","date":"2021-08-10"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a","date":"2021-08-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":34,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://www.securityfocus.com/bid/106914","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/106914","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0604","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","ctid-cve","dataset-annotation"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution; CTID attack_to_cve (Phase 1); TRAM2 annotated sentence label","mappingType":"exploitation_technique","evidence":[{"reportId":"SRC-f6d8447098e456600b00","quote":"Attackers linked to LookingFrog exploited Microsoft SharePoint servers in 2019 to gain code execution, probably by leveraging CVE-2019-0604.","start":7222,"end":7362}],"comment":"CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1608.001","name":"Upload Malware","tactics":["resource-development"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-f144807c3c05fbc98a1a","title":"Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","date":"2022-05-09","mentions":[{"quote":"Microsoft SharePoint servers affected by CVE-2019-0604","start":62442,"end":62496}]},{"id":"SRC-ea47048704591aa9939a","title":"Ghost in the shell: Investigating web shell attacks","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/","date":"2020-02-04","mentions":[{"quote":"To implant web shells, adversaries take advantage of security gaps in internet-facing web servers, typically vulnerabilities in web applications, for example CVE-2019-0604 or CVE-2019-16759.","start":2627,"end":2817}]},{"id":"SRC-f6d8447098e456600b00","title":"A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity","publisher":"welivesecurity.com","url":"https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/","date":null,"mentions":[{"quote":"Attackers linked to LookingFrog exploited Microsoft SharePoint servers in 2019 to gain code execution, probably by leveraging CVE-2019-0604.","start":7222,"end":7362}]},{"id":"SRC-54ba46a1d7e3fef03268","title":"UNC215: Spotlight on a Chinese Espionage Campaign in Israel","publisher":"fireeye.com","url":"https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-espionage-campaign-in-israel.html","date":null,"mentions":[{"quote":"CVE-2019-0604 to install web shells and FOCUSFJORD payloads at targets","start":1380,"end":1450},{"quote":"Microsoft SharePoint vulnerability CVE-2019-0604 was used to deliver","start":2589,"end":2657}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-1370","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1370","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":48053,"url":"https://www.exploit-db.com/exploits/48053","title":"Microsoft SharePoint - Deserialization Remote Code Execution","type":"remote","platform":"windows","date":"2020-01-21","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-01-21"},"pocGithub":{"count":7,"skipped":0,"earliest":"2019-03-23","earliestUrl":"https://github.com/linhlhq/CVE-2019-0604","repos":[{"name":"linhlhq/CVE-2019-0604","url":"https://github.com/linhlhq/CVE-2019-0604","stars":129,"created":"2019-03-23"},{"name":"k8gege/CVE-2019-0604","url":"https://github.com/k8gege/CVE-2019-0604","stars":99,"created":"2019-06-26"},{"name":"boxhg/CVE-2019-0604","url":"https://github.com/boxhg/CVE-2019-0604","stars":30,"created":"2019-12-10"},{"name":"Gh0st0ne/weaponized-0604","url":"https://github.com/Gh0st0ne/weaponized-0604","stars":8,"created":"2021-04-22"},{"name":"m5050/CVE-2019-0604","url":"https://github.com/m5050/CVE-2019-0604","stars":3,"created":"2019-09-15"}]},"first":{"date":"2019-03-23","source":"PoC-in-GitHub","url":"https://github.com/linhlhq/CVE-2019-0604"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1608.001","T1505.003","T1041"],"provenance":"source"},{"stage":"secondary","techniques":["T1003"],"provenance":"source"},{"stage":"related","techniques":["T1499.004"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-03-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0604","provenance":"source"},{"date":"2019-03-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2020-01-21","url":"https://github.com/linhlhq/CVE-2019-0604","provenance":"source"},{"date":"2019-05-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://threatpost.com/fin7-active-exploits-sharepoint/144628/","provenance":"source"},{"date":"2020-02-04","kind":"report","label":"Named in microsoft.com: Ghost in the shell: Investigating web shell attacks","url":"https://www.microsoft.com/en-us/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1370","provenance":"source"},{"date":"2022-05-09","kind":"report","label":"Named in microsoft.com: Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","provenance":"machine"}],"speed":{"daysToPublicExploit":18,"firstExploitFrom":"PoC-in-GitHub","daysToKev":974},"priority":{"score":88.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2729 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 7 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-sharepoint-cwe-20"}}