CVE-2019-9874
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
—
EPSS — probability of exploitation (30 days)
83.7%
99.7th percentile
CISA KEV
Listed
Added 2025-03-26 · patch by 2025-04-16
Weakness / dates
—
Published — · modified —
Timeline
- 2025-03-26 — Added to CISA KEV (actively exploited)
- 2025-04-16 — CISA patch-by deadline
Description
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.