Sitecore
Security incidents tagged Sitecore. Newest first.
0 Sitecore incidents in the last 12 months
- Incidents
- 2
- Live
- 0
- Patched
- 2
- Days without an incident
- 413
- Longest quiet run: 413 days (Sep 5–Oct 22)
Show 2 older incidents2 older incidents
September 2025 1
CriticalSitecore Multiple Products: Multiple Products Deserialization of Untrusted Data VulnerabilityPatched
Sitecore Multiple Products Patched
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. Added to CISA KEV on 2025-09-04.
Open incident →CVE-2025-53690
March 2025 1
CriticalSitecore CMS and Experience Platform (XP): 2 exploited vulnerabilities (CVE-2019-9874, CVE-2019-9875)Patched
Sitecore CMS and Experience Platform (XP) Patched
CVE-2019-9874: Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. CVE-2019-9875: Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. Added to CISA KEV on 2025-03-26.
Open incident →CVE-2019-9874 · CVE-2019-9875
