CVE Watch—

CVE-2019-0604

Microsoft SharePoint Remote Code Execution Vulnerability

CVSS

—

No CVSS

EPSS

99.9%

p100

KEV

YES

Nov 3, 2021

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

99.9%EPSS · 30 days99.9%

2026-09-162026-10-14

KEV catalog record

Product

Microsoft / SharePoint

Vulnerability

Microsoft SharePoint Remote Code Execution Vulnerability

Added to KEV

Nov 3, 2021

Remediate by

May 3, 2022

Known ransomware use

Yes

Summary description

Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2019-0604

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-656608.8 HIG

81.3%

KEV—74Microsoft SharePoint Code Injection Vulnerability19d CVE-2026-550409.1 CRI

99.4%

KEV—80Microsoft SharePoint Weak Authentication Vulnerability57d CVE-2026-586449.8 CRI

96.8%

KEV—79Microsoft SharePoint Deserialization of Untrusted Data Vulnerability90d CVE-2026-505229.8 CRI

87.3%

KEV—76Microsoft SharePoint Deserialization of Untrusted Data Vulnerability 84d CVE-2025-537709.8 CRI

100.0%

KEV—80Microsoft SharePoint Deserialization of Untrusted Data Vulnerability72d CVE-2025-497066.5 MED

99.9%

KEV—80Microsoft SharePoint Improper Authentication Vulnerability72d