CVE intelligenceCISA KEVRansomware use

CVE-2019-0604

Microsoft SharePoint Remote Code Execution Vulnerability

Published Mar 5, 2019Sources checked Sep 12, 2026

9.8CRITICALCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2019-0604 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft SharePoint.

Apply updates per vendor instructions.

CISA KEVListedObserved exploitation

EPSS99.9%Estimated 30-day exploitation probability

Ransomware useReported by CISACISA KEV ransomware field

Threat actors1Source-linked actor relationships

Overview

What is CVE-2019-0604?

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.