Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

Sitecore: actively exploited vulnerabilities

4 vulnerabilities in Sitecore products (Experience Platform / Manager (XP / XM)) are in CISA’s catalog of exploited vulnerabilities. Last added: September 4, 2025.

Sitecore security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Sitecore category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • Experience Platform / Manager (XP / XM) 4 vulnerabilities · CMS and websites

Name used by CISA: Sitecore. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Sitecore list.

  1. Rank 1Sitecore Experience Platform / Manager (XP / XM)

    CVE-2019-9874

    CVE from 2019, added in 2025

    Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 26, 2025
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  2. Rank 2Sitecore Experience Platform / Manager (XP / XM)

    CVE-2021-42237

    Ransomware

    Sitecore XP Remote Command Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  3. Rank 3Sitecore Experience Platform / Manager (XP / XM)

    CVE-2025-53690

    Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Sep 4, 2025
    CISA deadline
    21 days
    CVSS severity
    9.0 (critical)

  4. Rank 4Sitecore Experience Platform / Manager (XP / XM)

    CVE-2019-9875

    CVE from 2019, added in 2025

    Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 26, 2025
    CISA deadline
    21 days
    CVSS severity
    8.8 (high)

Follow and verify

Indicative classification, based on the vendor and product names given by CISA. How products are classified.