Sitecore
Vulnerability activity for Sitecore: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.0CriticalSep 3, 2025Sitecore Multiple Products DeserializationCVE-2025-53690Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. Added to KEV Sep 4, 2025 · same day as publicationExploited61% likelyExploit code
- 9.8CriticalMay 31, 2019Sitecore CMS and Experience Platform (XP) DeserializationCVE-2019-9874Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.Added to KEV Mar 26, 2025 · 2,125 days after publicationExploited84% likelyExploit codeNucleiDetection
- 8.8HighMay 31, 2019Sitecore CMS and Experience Platform (XP) DeserializationCVE-2019-9875Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.Added to KEV Mar 26, 2025 · 2,125 days after publicationExploited25% likely
- 9.8CriticalNov 5, 2021Sitecore XP DeserializationCVE-2021-42237Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.Added to KEV Mar 25, 2022 · 140 days after publicationExploited98% likelyExploit codeMetasploit · NucleiDetection
Recent
- 9.0CriticalSep 3, 2025Sitecore Multiple Products DeserializationCVE-2025-53690Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. Exploited61% likelyExploit code
- 7.5HighJun 17, 2025Sitecore experience commerce Auth bypass / access controlCVE-2025-34509Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.56% likelyNucleiDetection
- 8.8HighMay 31, 2019Sitecore CMS and Experience Platform (XP) DeserializationCVE-2019-9875Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.Exploited25% likely
- 9.8CriticalMay 31, 2019Sitecore CMS and Experience Platform (XP) DeserializationCVE-2019-9874Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.Exploited84% likelyExploit codeNucleiDetection
- 9.8CriticalNov 5, 2021Sitecore XP DeserializationCVE-2021-42237Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.Exploited98% likelyExploit codeMetasploit · NucleiDetection
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.