Brand
Sitecore: actively exploited vulnerabilities
4 vulnerabilities in Sitecore products (Experience Platform / Manager (XP / XM)) are in CISA’s catalog of exploited vulnerabilities. Last added: September 4, 2025.
The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).
-
0 vulnerabilities added in the last 12 months
-
4 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one Sitecore category to your radar, or open its page.
- CMS, e-commerce and websites 4 vulnerabilities
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
- Experience Platform / Manager (XP / XM)4 vulnerabilities, CMS and websites
Name used by CISA: Sitecore. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Sitecore list.
- Rank 1
Sitecore Experience Platform / Manager (XP / XM)CVE-2019-9874
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE from 2019, added in 2025
CVSS severity 9.8critical
Added Mar 26, 2025
- Rank 2
Sitecore Experience Platform / Manager (XP / XM)CVE-2021-42237
Sitecore XP Remote Command Execution Vulnerability
Ransomware
CVSS severity 9.8critical
Added Mar 25, 2022
- Rank 3
Sitecore Experience Platform / Manager (XP / XM)CVE-2025-53690
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
CVSS severity 9.0critical
Added Sep 4, 2025
- Rank 4
Sitecore Experience Platform / Manager (XP / XM)CVE-2019-9875
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE from 2019, added in 2025
CVSS severity 8.8high
Added Mar 26, 2025
Follow and verify
Indicative classification, based on the vendor and product names given by CISA. How products are classified.