Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 26/03/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| cms | ≤ 9.1 |
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free