Exploited vulnerabilities
Sitecore
4 Sitecore vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue4
Last 12 months0
In ransomware campaigns1
Last addition4 September 2025
The vulnerabilities4
- 4 September 2025CVE-2025-53690Multiple ProductsSitecore Multiple Products Deserialization of Untrusted Data Vulnerability
- 26 March 2025CVE-2019-9875CMS and Experience Platform (XP)Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- 26 March 2025CVE-2019-9874CMS and Experience Platform (XP)Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- 25 March 2022CVE-2021-42237XPSitecore XP Remote Command Execution VulnerabilityRansomware
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, Sitecore included.