Read the docs

Sitecore

Records40All Threatist records
Exploited (KEV)4In CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9

Exploited now

Sitecore records in CISA KEV
TI-2025-33607 Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability Priority CRITICAL 98KEV 2025-09-04TI-2019-07254 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Priority CRITICAL 100KEV 2025-03-26TI-2019-07255 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Priority CRITICAL 97KEV 2025-03-26TI-2021-18687 Sitecore XP Remote Command Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Experience Platform 21 records CRITICAL Experience Manager 11 records CRITICAL Experience Commerce 10 records CRITICAL Managed Cloud 9 records CRITICAL Cms 8 records CRITICAL Crm 2 records LOW Sitecore.net 2 records MEDIUM Rocks 1 record MEDIUM

Records

10 records in Experience Commerce · all components

TI-2025-33607 CVE-2025-53690 · GHSA-g5r9-cgwv-wmpc

Sitecore Products ViewState Deserialization Vulnerability

Priority CRITICAL 98KEV

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (X…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.6071 Published 2025-09-03 No fix listed CWE-502
TI-2025-33610 CVE-2025-53693 · GHSA-6jj2-mfwj-34q5

HTML Cache Poisoning through Unsafe Reflections

Priority HIGH 82

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects S…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20307 Published 2025-09-03 No fix listed CWE-470
TI-2025-24533 CVE-2025-34509 · GHSA-g93f-92gj-4q4x

Sitecore XM and XP Hardcoded Credentials

Priority HIGH 74

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.55874 Published 2025-06-17 Fixed in 10.4.1 rev. 011941 PRE, 10.3.3 rev. 011967 PRE +1 CWE-798
TI-2025-33608 CVE-2025-53691 · GHSA-cpg3-c796-vg5v

Sitecore Experience Remote Code Execution through Insecure Deserialization

Priority HIGH 73

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3,…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01636 Published 2025-09-03 No fix listed CWE-502
TI-2025-24535 CVE-2025-34511 · GHSA-74ph-965p-2jc2

Sitecore PowerShell Extension RCE via Unrestricted Upload

Priority HIGH 73

Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.30446 Published 2025-06-17 No fix listed CWE-434
TI-2025-24534 CVE-2025-34510 · GHSA-mh69-97fr-wj66

Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

Priority HIGH 73

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.24835 Published 2025-06-17 No fix listed CWE-23
TI-2025-33611 CVE-2025-53694 · GHSA-vmj4-jxq2-r8rx

Information Disclosure in ItemServices API

Priority HIGH 72

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 throu…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06854 Published 2025-09-03 No fix listed CWE-200
Open these records in search →