Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
|
Sitecore | Multiple Products | Sep 4, 2025 | Sep 25, 2025 | |
|
CVE-2019-9874 — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
|
Sitecore | CMS and Experience Platform (XP) | Mar 26, 2025 | Apr 16, 2025 | |
|
CVE-2019-9875 — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
|
Sitecore | CMS and Experience Platform (XP) | Mar 26, 2025 | Apr 16, 2025 | |
|
CVE-2021-42237 — Sitecore XP Remote Command Execution Vulnerability
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
|
Sitecore | XP | Mar 25, 2022 | Apr 15, 2022 | Ransomware |
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
Multiple Products · Sep 4, 2025
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
CMS and Experience Platform (XP) · Mar 26, 2025
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
CMS and Experience Platform (XP) · Mar 26, 2025
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
XP · Mar 25, 2022