What’s Vulnerable › Vulnerabilities

CVE-2019-9874: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-03-26
• EPSS: 83.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-31 · updated 2026-06-17
• Weakness: CWE-502

Description

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

Affected products

• Sitecore Cms: from 7.0 through 7.2
• Sitecore Experience Platform: from 7.5 through 8.2

References

• https://dev.sitecore.net/Downloads.aspx
• https://www.synacktiv.com/blog.html
• https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf
• https://dev.sitecore.net/Downloads.aspx
• https://www.synacktiv.com/blog.html
• https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9874

Get alerted when CVE-2019-9874 or the next vulnerability affects your stack