Critical Remote Code Execution in Microsoft SharePoint (CVE‑2019‑0604) Bypasses Application Package Validation
What It Is – Microsoft SharePoint Server fails to validate the source markup of an application package, allowing an unauthenticated attacker to inject malicious code.
Exploitability – Publicly disclosed exploit code exists; CVSS v3.1 base score 9.8 (Critical). Active exploitation has been observed in the wild.
Affected Products – Microsoft SharePoint Server (on‑premises) versions 2016, 2019 and earlier releases that have not applied the March 2020 security update.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous patch‑management program that can produce verifiable evidence of remediation for auditors.
- Highlights a configuration‑control gap; mapping this to a control objective (e.g., “Maintain secure configuration and apply security updates”) satisfies many frameworks simultaneously (NIST CSF 2.0 → Protect / Maintain).
- Enables organizations to show defensible audit trails—log the patch deployment, retain proof of remediation, and feed that into a Trust Center dashboard for third‑party assurance.
Recommended Actions
- Deploy Microsoft’s March 2020 security update (or later) to all SharePoint servers immediately.
- Run an authenticated scan (e.g., Microsoft Defender for Cloud or a trusted scanner) to confirm the vulnerability is remediated.
- Update your asset inventory and configuration‑baseline records; capture patch‑installation logs as evidence for compliance audits.
- Incorporate the patch‑status check into your continuous monitoring pipeline.
Source: CISA KEV – CVE‑2019‑0604