Sitecore known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 4 Sitecore vulnerabilities: 0 added in the last 365 days, 3 rated critical (CVSS 9 or higher), and 1 with known ransomware use. The most recent was added Sep 4, 2025.
RSS feed for Sitecore exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2025-09-04 | CVE-2025-53690 | Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability | 9 (v3.1) | 60.6% | 2025-09-25 | Unknown |
| 2025-03-26 | CVE-2019-9874 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | 9.8 (v3.1) | 83.7% | 2025-04-16 | Unknown |
| 2025-03-26 | CVE-2019-9875 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | 8.8 (v3.1) | 25.4% | 2025-04-16 | Unknown |
| 2022-03-25 | CVE-2021-42237 | Sitecore XP Remote Command Execution Vulnerability | 9.8 (v3.1) | 97.6% | 2022-04-15 | Known |