CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization
Unauthenticated attackers can execute arbitrary code in Sitecore CMS by sending a malicious serialized .NET object in the CSRF token parameter.
- Exploited in the wild
- Since 26 Mar 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-9874?
CVE-2019-9874 is a critical unsafe deserialization vulnerability in n/a, published on 31 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Weakness: CWE-502
Which versions are affected by CVE-2019-9874?
It affects 2 products.
Products include Sitecore Cms, Sitecore Experience Platform.
How do I fix CVE-2019-9874?
No fix has been published for CVE-2019-9874 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 16 Apr 2025.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-9874 being exploited?
Yes. Attackers have exploited CVE-2019-9874 in the wild since at least 26 Mar 2025.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2019-9875 Sitecore CMS and Experience Platform (XP) Deserialization
- CVE-2019-11198 Cross-site scripting in n/a
- CVE-2017-11439 In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.
- CVE-2017-11440 In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter.
- CVE-2014-100004 Cross-site scripting in n/a
Sources
Also known as GHSA-wfwm-vf76-3692.