Kentico · Xperience

CVE-2019-10068

Kentico Xperience Deserialization of Untrusted Data Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 95%

What it is

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.

CISA: Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 15, 2022

Added to the CISA list: March 25, 2022
Published: March 26, 2019
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 95% in the top 0.1% of all known vulnerabilities
Weakness: CWE-502
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Kentico

Added	Vulnerability	Product	Severity	Attack chance
Apr 20, 2026	Xperience Path TraversalCVE-2025-2749	Kentico Xperience	High 7.2	4.0%
Oct 20, 2025	Authentication Bypass Using an Alternate Path or ChannelCVE-2025-2746	Xperience CMS	Critical 9.8	74%
Oct 20, 2025	Authentication Bypass Using an Alternate Path or ChannelCVE-2025-2747	Xperience CMS	Critical 9.8	97%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.