Sitecore vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Sitecore flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted DataExploited since Sep 4, 2025 · CVSS 9
• CVE-2019-9875 Sitecore CMS and Experience Platform (XP) DeserializationExploited since Mar 26, 2025 · CVSS 8.8
• CVE-2019-9874 Sitecore CMS and Experience Platform (XP) DeserializationExploited since Mar 26, 2025 · CVSS 9.8
• CVE-2021-42237 Sitecore XP Remote Command ExecutionExploited since Mar 25, 2022 · ransomware · CVSS 9.8

Latest high and critical flaws

• CVE-2025-53692 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), SitecoreHigh 7.1 · Sep 21, 2025
• CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted DataExploited · Critical 9 · Sep 3, 2025
• CVE-2025-53694 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This isHigh 7.5 · Sep 3, 2025
• CVE-2025-53693 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore ExperienCritical 9.8 · Sep 3, 2025
• CVE-2025-53691 Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This iHigh 8.8 · Sep 3, 2025
• CVE-2025-34139 A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthentiHigh 8.7 · Jul 25, 2025
• CVE-2020-36850 An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be sHigh 8.7 · Jul 25, 2025
• CVE-2025-34511 Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestrictedHigh 8.8 · Jun 17, 2025
• CVE-2025-34510 Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip SlHigh 8.8 · Jun 17, 2025
• CVE-2025-34509 Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev.High 7.5 · Jun 17, 2025
• CVE-2024-46938 An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial RelHigh 7.5 · Sep 15, 2024
• CVE-2023-35813 Multiple Sitecore products allow remote code execution.Critical 9.8 · Jun 17, 2023
• CVE-2023-33653 Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/ContHigh 8.8 · Jun 6, 2023
• CVE-2023-33652 Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/InHigh 8.8 · Jun 6, 2023
• CVE-2023-33651 An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 IHigh 7.5 · Jun 6, 2023
• CVE-2023-27068 Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.Critical 9.8 · May 22, 2023
• CVE-2023-27067 Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to downloHigh 7.5 · May 22, 2023
• CVE-2023-26262 An issue was discovered in Sitecore XP/XM 10.3.High 7.2 · Mar 14, 2023
• CVE-2021-42237 Sitecore XP Remote Command ExecutionExploited · Critical 9.8 · Nov 5, 2021
• CVE-2021-38366 Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting High 8.8 · Aug 12, 2021
• CVE-2019-11080 Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863.High 8.8 · Jun 6, 2019
• CVE-2019-9875 Sitecore CMS and Experience Platform (XP) DeserializationExploited · High 8.8 · May 31, 2019
• CVE-2019-9874 Sitecore CMS and Experience Platform (XP) DeserializationExploited · Critical 9.8 · May 31, 2019
• CVE-2019-12440 The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard RCritical 9.8 · May 29, 2019
• CVE-2018-7669 An issue was discovered in Sitecore Sitecore.NET 8.1 rev.High 7.5 · Apr 27, 2018