Sitecore Experience Platform vulnerabilities

22 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Exploited Sitecore Experience Platform vulnerabilities

CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
CVE-2019-9874 — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2021-42237 — Sitecore XP Remote Command Execution Vulnerability

CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability (CVSS 9.0) — exploited
CVE-2025-53694 — Information Disclosure in ItemServices API (CVSS 7.5)
CVE-2025-53693 — HTML Cache Poisoning through Unsafe Reflections (CVSS 9.8)
CVE-2025-53691 — Sitecore Experience Remote Code Execution through Insecure Deserialization (CVSS 8.8)
CVE-2022-4979 — Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS (CVSS 5.1)
CVE-2025-34511 — Sitecore PowerShell Extension RCE via Unrestricted Upload (CVSS 8.8)
CVE-2025-34510 — Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip (CVSS 8.8)
CVE-2025-34509 — Sitecore XM and XP Hardcoded Credentials (CVSS 7.5)
CVE-2024-46938 — (CVSS 7.5)
CVE-2023-35813 — (CVSS 9.8)
CVE-2023-33653 — (CVSS 8.8)
CVE-2023-33652 — (CVSS 8.8)
CVE-2023-33651 — (CVSS 7.5)
CVE-2023-27068 — (CVSS 9.8)
CVE-2023-27067 — (CVSS 7.5)
CVE-2023-27066 — (CVSS 6.5)
CVE-2023-26262 — (CVSS 7.2)
CVE-2021-42237 — Sitecore XP Remote Command Execution Vulnerability (CVSS 9.8) — exploited
CVE-2019-13493 — (CVSS 5.4)
CVE-2019-11080 — (CVSS 8.8)
CVE-2019-9874 — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (CVSS 9.8) — exploited
CVE-2016-8855 — (CVSS 6.1)