Critical severity · published May 31, 2019
CVE-2019-9874
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
In wildKEV
9.8
CVSS
83.7%
EPSS
Yes
On KEV
Description
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)83.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 26, 2025
Federal remediation dueApr 16, 2025
Ransomware campaign useNot known
Affected products
Which versions
CM
Cms · Sitecore
7.0 through 7.2 · source: NVD
EP
Experience Platform · Sitecore
7.5 through 8.2 · source: NVD
CA
CMS and Experience Platform (XP) · Sitecore
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-9874
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-9874
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://dev.sitecore.net/Downloads.aspx
x_refsource_MISC
https://www.synacktiv.com/blog.html
x_refsource_MISC
https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf
More from Cms
8.8
CVE-2019-9875
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
6.1
CVE-2019-11198
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List…
5.4
CVE-2017-11439
In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter
4.9
CVE-2017-11440
In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter
–
CVE-2014-100004
Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev