CVE-2019-10068 Kentico Xperience Deserialization of Untrusted Data

Exploited in the wild Critical 9.8 Published 26 Mar 2019 Updated 21 Oct 2025

Unauthenticated attackers can achieve remote code execution on Kentico servers by sending crafted requests to the staging service, bypassing authentication and triggering unsafe deserialization.

Exploited in the wild: Since 25 Mar 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-10068?

CVE-2019-10068 is a critical unsafe deserialization vulnerability in Kentico Xperience, published on 26 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.

Weakness: CWE-502

Which versions are affected by CVE-2019-10068?

It affects 1 product.

Products include Kentico Xperience.

How do I fix CVE-2019-10068?

No fix has been published for CVE-2019-10068 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Apr 2022.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2019-10068 being exploited?

Yes. Attackers have exploited CVE-2019-10068 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.

All Kentico Xperience vulnerabilities

Sources

Also known as GHSA-f7w4-79f7-fhp3.