CVE-2019-11080

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-06 · updated 2026-06-17
Weakness: CWE-502

Description

Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.

Affected products

Sitecore Experience Platform: before 9.1.1 — fixed in 9.1.1

How to fix

Upgrade to a fixed version: Sitecore Experience Platform 9.1.1. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html
https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes
https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE
http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html
https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes
https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE

Get alerted when CVE-2019-11080 or the next vulnerability affects your stack