CVE-2021-42237

Sitecore XP Remote Command Execution Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 98%

What it is

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

CISA: Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 15, 2022

Added to the CISA list: March 25, 2022
Published: November 5, 2021
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 98% in the top 0.1% of all known vulnerabilities
Weakness: CWE-502
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Sitecore

Added	Vulnerability	Product	Severity	Attack chance
Sep 4, 2025	Deserialization of Untrusted DataCVE-2025-53690	Multiple Products	Critical 9.0	61%
Mar 26, 2025	DeserializationCVE-2019-9874	CMS and Experience Platform (XP)	Critical 9.8	84%
Mar 26, 2025	DeserializationCVE-2019-9875	CMS and Experience Platform (XP)	High 8.8	25%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.