[critical] Sitecore Multiple Products: Multiple Products Deserialization of Untrusted Data Vulnerability

Thu, 04 Sep 2025 00:00:00 GMT

Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. Added to CISA KEV on 2025-09-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-04: CISA added CVE-2025-53690 to the KEV catalog (due 2025-09-25).

CVEs: CVE-2025-53690

[critical] Sitecore CMS and Experience Platform (XP): 2 exploited vulnerabilities (CVE-2019-9874, CVE-2019-9875)

Wed, 26 Mar 2025 00:00:00 GMT

CVE-2019-9874: Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. CVE-2019-9875: Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. Added to CISA KEV on 2025-03-26.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-26: CISA added CVE-2019-9874 to the KEV catalog (due 2025-04-16).
2025-03-26: CISA added CVE-2019-9875 to the KEV catalog (due 2025-04-16).

CVEs: CVE-2019-9874, CVE-2019-9875

pwn.watch: Sitecore incident updates

[critical] Sitecore Multiple Products: Multiple Products Deserialization of Untrusted Data Vulnerability

[critical] Sitecore CMS and Experience Platform (XP): 2 exploited vulnerabilities (CVE-2019-9874, CVE-2019-9875)