VULNERABILITY INTELLIGENCE

CVE-2021-42237

CVSS score9.8 CRITICAL

EPSS probability97.57%

CISA KEVKnown exploited vulnerability

Published2021-11-05

Last modified2026-07-09

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Sitecore XP Remote Command Execution Vulnerability

Vendor / product: Sitecore / XP

Description

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Weakness classification

nvd@nist.gov: CWE-502
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-502

Primary references

cve@mitre.org — Third Party Advisory, VDB Entry
cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource