Servers and applications
CVE-2019-9874
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 26 Mar 2025.
- Severity
- Critical 9.8
- Published
- 31 May 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 84% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Sitecore Experience PlatformServers and applications · cpe:a:sitecore:experience_platform |
|
Known exploited
- CISA name
- Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due for US agencies
- 16 Apr 2025
- Used in ransomware
- Not known