CVE-2019-0604 Microsoft SharePoint Remote Code Execution

Exploited in the wild Critical 9.8 Published 6 Mar 2019 Updated 21 Oct 2025

Attackers can execute arbitrary code remotely by exploiting improper source markup validation in Microsoft SharePoint application packages.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-0604?

CVE-2019-0604 is a critical code injection vulnerability in Microsoft Sharepoint Enterprise Server, published on 6 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.

Weakness: CWE-20

Which versions are affected by CVE-2019-0604?

It affects 3 products.

Products include Microsoft Sharepoint Enterprise Server, Microsoft Sharepoint Foundation, Microsoft Sharepoint Server.

How do I fix CVE-2019-0604?

No fix has been published for CVE-2019-0604 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-0604 being exploited?

Yes. Attackers have exploited CVE-2019-0604 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Exploit-DB entry and 7 proofs of concept on GitHub.

All Microsoft Sharepoint Enterprise Server vulnerabilities

Sources

Also known as GHSA-6mr5-xh3f-7vqm.