Microsoft SharePoint Remote Code Execution (RCE) Vulnerability (CVE-2019-0604) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft SharePoint Server 2010, 2013, 2016, 2019, and SharePoint Foundation 2013
Unauthenticated remote attackers can execute arbitrary code with the privileges of the SharePoint IIS application pool (w3wp.exe) by sending a specially crafted application package, leading to complete system compromise
Immediately apply the official Microsoft security updates and perform compromise assessments on internet-facing SharePoint servers
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Deploy the appropriate Cumulative Update (CU) or Security Update (SU) for your specific SharePoint version. After installing the patch, you must run the SharePoint Products Configuration Wizard to complete the deployment.
# Verify the current SharePoint Farm Build Version
Get-SPFarm | Select-Object BuildVersion
# Run the SharePoint Configuration Wizard via PowerShell to apply the patch
cd 'C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\BIN'
.\PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, restrict external access to vulnerable endpoints using IIS URL Rewrite rules to block suspicious requests.
<!-- Add this URL Rewrite rule to the web.config file of the SharePoint IIS site to block external access to Picker.aspx -->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name='Restrict Picker Access' stopProcessing='true'>
<match url='.*Picker\.aspx' />
<conditions>
<add input='{REMOTE_ADDR}' pattern='^10\.' negate='true' />
</conditions>
<action type='CustomResponse' statusCode='403' statusReason='Forbidden' />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>3. Log Audit & IoC Verification Commands
Inspect IIS access logs and Windows Security Event logs to identify potential exploitation attempts and unauthorized child processes spawned by the IIS worker process.
# Search IIS logs for suspicious POST requests targeting Picker.aspx
Get-ChildItem -Path 'C:\inetpub\logs\LogFiles\' -Recurse -Filter '*.log' |
Select-String -Pattern 'POST /_layouts/15/Picker.aspx' |
Select-Object -First 100
# Check Windows Security Event Log (Event ID 4688) for cmd.exe or powershell.exe spawned by w3wp.exe
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} |
Where-Object {$_.Message -like '*w3wp.exe*' -and ($_.Message -like '*cmd.exe*' -or $_.Message -like '*powershell.exe*')}Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a critical remote code execution (RCE) flaw in Microsoft SharePoint that occurs when the software fails to properly inspect and validate the source markup of an application package. The root cause lies in the unsafe deserialization (CWE-20) of untrusted XML/object data within SharePoint's internal APIs (such as the EntityInstanceIdEncoder class). When processing malicious serialized payloads, the application instantiates arbitrary .NET objects, allowing attackers to bypass security boundaries.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by sending a specially crafted HTTP POST request containing a malicious XML payload to vulnerable SharePoint endpoints, such as /_layouts/15/Picker.aspx or other web services handling business data connectivity. The payload typically leverages .NET gadgets (e.g., ExpandedWrapper or ObjectDataProvider) to trigger system-level command execution. Upon receiving the request, the SharePoint server deserializes the payload, executing the embedded commands under the security context of the IIS worker process (w3wp.exe) without requiring any authentication.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and its inclusion in the CISA KEV catalog, this vulnerability represents an extreme threat vector. It has been actively exploited in the wild by advanced persistent threat (APT) actors and ransomware groups. Successful exploitation grants the attacker an initial foothold inside the enterprise network, enabling lateral movement, Active Directory credential harvesting, sensitive data exfiltration, and full-scale ransomware deployment.
Official Vendor Advisories & References
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
Frequently Asked SecOps Questions (CVE-2019-0604)
FAQQ1. How critical is CVE-2019-0604 and is it actively exploited in the wild?
CVE-2019-0604 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-0604?
Primary impacted vendors include microsoft across sharepoint, sharepoint_server, sharepoint_foundation. Scope summary: Microsoft SharePoint Foundation 2013 Service Pack 1, SharePoint Server 2010 Service Pack 2, SharePoint Server 2013 Service Pack 1, SharePoint Server 2016, and SharePoint Server 2019
Q3. What temporary mitigations or workarounds exist for CVE-2019-0604 before patching?
[Mitigation] Immediately apply the official Microsoft security updates and perform compromise assessments on internet-facing SharePoint servers Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-0604
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft SharePoint Spoofing Vulnerability due to Improper Input Validation (CVE-2026-32201)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft Office SharePoint Missing Authentication Privilege Escalation Vulnerability (CVE-2026-56164) Security Advisory
[Affected Scope] Microsoft Office SharePoint Server environments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.