High severity · published Jul 15, 2019
CVE-2019-1006
An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary…
7.5
CVSS
6.1%
EPSS
No
On KEV
Description
An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
SharePoint · Microsoft
2019 · source: NVD
WI
Windows · Microsoft
1607; 1703; 1709; 1803; 1809; 1903 · source: NVD
NF
.net Framework · Microsoft
2.0; 3.0; 3.5; 3.5; 4.7.2; 3.5; +14 more · source: NVD
ID
Identitymodel · Microsoft
7.0.0 · source: NVD
SE
Sharepoint Enterprise Server · Microsoft
2013; 2016 · source: NVD
SF
Sharepoint Foundation · Microsoft
2010; 2013 · source: NVD
W7
Windows 7 · Microsoft
All versions, or not specified · source: NVD
W8
Windows 8.1 · Microsoft
All versions, or not specified · source: NVD
WR
Windows RT 8.1 · Microsoft
All versions, or not specified · source: NVD
WS
Windows Server 2008 · Microsoft
r2; r2 · source: NVD
WS
Windows Server 2012 · Microsoft
r2 · source: NVD
WS
Windows Server 2016 · Microsoft
1803; 1903 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1006
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1006
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1006
More from SharePoint
9.8
CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2026-50522
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2026-56164
Microsoft SharePoint Server Elevation of Privilege Vulnerability
9.8
CVE-2026-20963
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability