CVE-2019-9875 Sitecore CMS and Experience Platform (XP) Deserialization
An authenticated attacker can execute arbitrary code in Sitecore by sending a malicious serialized .NET object via HTTP POST.
- Exploited in the wild
- Since 26 Mar 2025
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-9875?
CVE-2019-9875 is a high-severity unsafe deserialization vulnerability in n/a, published on 31 May 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
Weakness: CWE-502
Which versions are affected by CVE-2019-9875?
It affects 1 product.
Products include Sitecore Cms.
How do I fix CVE-2019-9875?
No fix has been published for CVE-2019-9875 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 16 Apr 2025.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-9875 being exploited?
Yes. Attackers have exploited CVE-2019-9875 in the wild since at least 26 Mar 2025.
Other vulnerabilities in n/a
- CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization
- CVE-2019-11198 Cross-site scripting in n/a
- CVE-2017-11439 In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.
- CVE-2017-11440 In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter.
- CVE-2014-100004 Cross-site scripting in n/a
Sources
Also known as GHSA-7gvq-j6pg-875g.