PatchTheCVECVE-2019-1006: An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity F
60
This week
HIGH 7.5REMOTEWATCHLISTDOWNGRADEDOWNGRADEDOWNGRADE
CVE-2019-1006 is a high-severity flaw (CVSS 7.5) affecting .net framework, identitymodel, sharepoint enterprise server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.
Why this priority
- High severity
- EPSS top 7%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 6.1% (top 7%) |
| CISA exploited list | No |
| Weakness | CWE-295 |
| Published | 2019-07-15 |
| Last modified | 2026-06-17 |
Publisher (CNA): Microsoft Corporation · Vendor: microsoft
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
microsoft .net framework DOWNGRADE
Affected: 2.0 sp2 · 3.0 sp2 · 3.5 · 4.7.2 · 4.8 · 3.5.1 · 4.5.2 · 4.6
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy .net-framework || rpm -q .net-framework || .net-framework --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison .net-framework
sudo apt install .net-framework=<VERSION_BEFORE_2.0>
sudo apt-mark hold .net-framework
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list .net-framework
sudo dnf downgrade .net-framework-<VERSION_BEFORE_2.0>
sudo dnf versionlock add .net-framework
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft identitymodel DOWNGRADE
Affected: 7.0.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0.0
1. Check installed version
apt-cache policy identitymodel || rpm -q identitymodel || identitymodel --version
2. No fixed release: DOWNGRADE to a release before 7.0.0 (Debian / Ubuntu)
apt-cache madison identitymodel
sudo apt install identitymodel=<VERSION_BEFORE_7.0.0>
sudo apt-mark hold identitymodel
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list identitymodel
sudo dnf downgrade identitymodel-<VERSION_BEFORE_7.0.0>
sudo dnf versionlock add identitymodel
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft sharepoint enterprise server DOWNGRADE
Affected: 2013 sp1 · 2016
Fixed in: no fixed release known
Safe to downgrade to: a release before 2013
1. Check installed version
apt-cache policy sharepoint-enterprise-server || rpm -q sharepoint-enterprise-server || sharepoint-enterprise-server --version
2. No fixed release: DOWNGRADE to a release before 2013 (Debian / Ubuntu)
apt-cache madison sharepoint-enterprise-server
sudo apt install sharepoint-enterprise-server=<VERSION_BEFORE_2013>
sudo apt-mark hold sharepoint-enterprise-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sharepoint-enterprise-server
sudo dnf downgrade sharepoint-enterprise-server-<VERSION_BEFORE_2013>
sudo dnf versionlock add sharepoint-enterprise-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft sharepoint foundation DOWNGRADE
Affected: 2010 sp2 · 2013 sp1
Fixed in: no fixed release known
Safe to downgrade to: a release before 2010
1. Check installed version
apt-cache policy sharepoint-foundation || rpm -q sharepoint-foundation || sharepoint-foundation --version
2. No fixed release: DOWNGRADE to a release before 2010 (Debian / Ubuntu)
apt-cache madison sharepoint-foundation
sudo apt install sharepoint-foundation=<VERSION_BEFORE_2010>
sudo apt-mark hold sharepoint-foundation
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sharepoint-foundation
sudo dnf downgrade sharepoint-foundation-<VERSION_BEFORE_2010>
sudo dnf versionlock add sharepoint-foundation
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft sharepoint server DOWNGRADE
Affected: 2019
Fixed in: no fixed release known
Safe to downgrade to: a release before 2019
1. Check installed version
apt-cache policy sharepoint-server || rpm -q sharepoint-server || sharepoint-server --version
2. No fixed release: DOWNGRADE to a release before 2019 (Debian / Ubuntu)
apt-cache madison sharepoint-server
sudo apt install sharepoint-server=<VERSION_BEFORE_2019>
sudo apt-mark hold sharepoint-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sharepoint-server
sudo dnf downgrade sharepoint-server-<VERSION_BEFORE_2019>
sudo dnf versionlock add sharepoint-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft windows 10 MITIGATE
Affected: all versions · 1607 · 1703 · 1709 · 1803 · 1809 · 1903
Fixed in: no fixed release known
Safe to downgrade to: a release before 1607
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-1006?
.net framework: downgrade or apply the listed mitigation; identitymodel: downgrade or apply the listed mitigation; sharepoint enterprise server: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-1006 being exploited?
CVE-2019-1006 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-1006 affect?
CVE-2019-1006 affects .net framework, identitymodel, sharepoint enterprise server. Severity is high (CVSS 7.5). An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vuln
How urgent is CVE-2019-1006?
Priority 60/100. High severity; EPSS top 7%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Windows vulnerabilities · SharePoint vulnerabilities · .NET vulnerabilities
Related CVEs
- CVE-2026-70354 HIGH 7.8 UPGRADE UPGRADE Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
- CVE-2026-62897 HIGH 7.0 DOWNGRADE UPGRADE Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
- CVE-2026-50659 MEDIUM 6.5 DOWNGRADE UPGRADE Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a netwo
- CVE-2026-50650 HIGH 7.8 DOWNGRADE UPGRADE Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to
- CVE-2026-50649 HIGH 7.8 DOWNGRADE UPGRADE Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.