Login Request a demo
Critical severity · published Nov 5, 2021
CVE-2021-42237
Sitecore XP Remote Command Execution Vulnerability
RansomwareIn wildKEV
9.8
CVSS
97.6%
EPSS
Yes
On KEV
Description
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)97.6% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 25, 2022
Federal remediation dueApr 15, 2022
Ransomware campaign useKnown
Affected products
Which versions
EP
Experience Platform · Sitecore
7.5; 7.5; 7.5; 8.0; 8.0; 8.0; +18 more · source: NVD
XP
XP · Sitecore
All versions, or not specified · source: KEV
Affected product
EP
Experience Platform
Sitecore
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-42237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-42237
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.sitecore.com
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776
blog.assetnote.io
https://blog.assetnote.io/2021/11/02/sitecore-rce/
packetstormsecurity.com
http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html
More from Experience Platform
9.8
CVE-2019-9874
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
9.0
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
9.8
CVE-2025-53693
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP)…
9.8
CVE-2023-35813
Multiple Sitecore products allow remote code execution
9.8
CVE-2023-27068
Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx