CVE-2019-9874CISA KEVEPSS p99.7%

CVE-2019-9874Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sitecore / CMS and Experience Platform (XP)

Description

Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

Scoring

EPSS83.86% probability of exploitation · percentile 99.7% · 2026-06-16T12:03:06Z

CISA KEV entry

Added to KEV: 2025-03-26

(incoming)1

TypeTargetConfidenceTier
KEVEntrySitecore CMS and Experience Platform (XP) Deserialization Vulnerabilitykev-cve-2019-98740%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
Sitecore XP Remote Command Execution Vulnerability
CVE
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
CVE
CVE-2025-53691
CVE
Kentico Xperience Deserialization of Untrusted Data Vulnerability
CVE
Microsoft SharePoint Deserialization Vulnerability
CVE
DotNetNuke (DNN) Remote Code Execution Vulnerability
Sourced from NVD + CISA KEV + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.