Skip to main content

Sitecore CVE-2021-42237

CRITICAL
Deserialization of Untrusted Data (CWE-502)
2021-11-05 cve@mitre.org
Deserialization Experience Platform Sitecore
9.8
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-502
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS score of 9.8 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. CISA has confirmed active exploitation in the wild. Public proof-of-concept exploit code is available. EPSS exploitation probability: 99.21%.
Exploit ScenarioDerived

A remote attacker could execute arbitrary code through malicious serialized objects by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability.
Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.
Exploited in the wild (CISA KEV) No patch listed yet 99.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability. Affected products include: Sitecore Experience Platform.

Know when Sitecore gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Added to CISA KEV
Jul 05, 2026 - 01:31 CISA
CVE Published
Nov 05, 2021 - 10:15 nvd
CRITICAL 9.8

DescriptionNVD

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Threat Intelligence Overview

Threat Score
7.9/10
Composite threat intelligence
EPSS Score
99.2%
Top 0% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org CISA KEV EPSS POC (2) VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV Yes
Public POC Yes
EPSS 99.2%
Patch available No
Active threat Yes
Deciding rule
CRITICAL + in CISA KEV (actively exploited), no patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
High

Priority Score

233
Low Medium High Critical
KEV: +50
EPSS: +99
CVSS: +49
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

Affected Products (CPE)NVD

cpe:2.3:a:sitecore:experience_platform:7.5:-:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:7.5:update1:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:7.5:update2:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:-:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:sp1:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:update1:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:update2:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:update3:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:update4:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:update5:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:update6:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.0:update7:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.1:-:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.1:update1:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.1:update2:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.1:update3:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.2:-:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.2:update1:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.2:update2:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:8.2:update3:*:*:*:*:*:*
+ 4 more

More in Sitecore

View all
CVE-2025-34510 HIGH POC
8.8 Jun 17

Sitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
CVE-2025-34511 HIGH POC
8.8 Jun 17

Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
CVE-2025-34509 HIGH POC
7.5 Jun 17

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
CVE-2023-35813 CRITICAL POC
9.8 Jun 17

Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2023-27068 CRITICAL POC
9.8 May 23

Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary

CVE-2019-9874 CRITICAL POC
9.8 May 31

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
CVE-2023-33653 HIGH POC
8.8 Jun 06

Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerabil
CVE-2023-33652 HIGH POC
8.8 Jun 06

Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerabil
CVE-2021-38366 HIGH POC
8.8 Aug 12

Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and ac
CVE-2019-11080 HIGH POC
8.8 Jun 06

Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 2
CVE-2019-9875 HIGH POC
8.8 May 31

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
CVE-2025-53694 HIGH POC
7.5 Sep 03

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2020-0618 HIGH POC
8.8

Same technique Deserialization

View all
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9
CVE-2021-23758 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY http://sitecore.com ADVISORY https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776 ADVISORY https://vuldb.com/vuln/186119 REF http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy