CRITICALCVSS v3.1 9.8Actively exploited · CISA KEV since 2021-11-03Vulnerability
CVE-2019-0604
Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.
Properties
- Euvd product
- Microsoft SharePoint Server, Microsoft SharePoint Foundation, Microsoft SharePoint Enterprise Server
- Vulnerability name
- Microsoft SharePoint Remote Code Execution Vulnerability
- First seen
- 2025-10-21T23:45:42+00:00
- Cvss score
- 9.8
- Epss score
- 0.99913
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2022-05-03
- Euvd assigner
- microsoft
- Retrieved at
- 2026-10-21T01:24:47+00:00
- Exploited euvd since
- 2021-11-03T00:00:00+00:00
- Src batch id
- epss_history-20261020T103617Z-728ddd
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Date added
- 2021-11-03
- Score
- 9.8
- Euvd base score version
- 3.1
- Fetched at
- 2026-10-20T10:36:20+00:00
- Euvd vendor
- Microsoft
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 9.8
Related Entities (7)
AFFECTS_PRODUCT (4)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
Explore deeper with Ninja Signal's threat intelligence graph