CVE-2019-9875CISA KEVEPSS p96.1%

CVE-2019-9875Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sitecore / CMS and Experience Platform (XP)

Description

Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

Scoring

EPSS14.15% probability of exploitation · percentile 96.1% · 2026-06-18T12:00:27Z

CISA KEV entry

Added to KEV: 2025-03-26

(incoming)1

TypeTargetConfidenceTier
KEVEntrySitecore CMS and Experience Platform (XP) Deserialization Vulnerabilitykev-cve-2019-98750%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
Sitecore XP Remote Command Execution Vulnerability
CVE
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
CVE
CVE-2025-53691
CVE
Kentico Xperience Deserialization of Untrusted Data Vulnerability
CVE
Microsoft SharePoint Deserialization Vulnerability
CVE
DotNetNuke (DNN) Remote Code Execution Vulnerability
Sourced from NVD + CISA KEV + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.