CVE Intelligence

Sitecore vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Sitecore products: 4 record(s), with severity, exploitation and fixes.

Experience Platform 3Cms 2Experience Commerce 1Experience Manager 1Managed Cloud 1Experience Manager (XM) 1Experience Platform (XP) 1

Exploited only (KEV) →

CVE-2025-53690 Critical · 9.0 KEV High · 66 Public exploit CWE-502 Sep 3, 2025
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
CVE-2021-42237 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-502 Nov 5, 2021
Sitecore XP Remote Command Execution Vulnerability
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
CVE-2019-9874 Critical · 9.8 KEV High · 67 Public exploit CWE-502 May 31, 2019
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
CVE-2019-9875 High · 8.8 KEV High · 55 CWE-502 May 31, 2019
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.