ZeusQA
Start free

Known exploited vulnerabilities

Sitecore vulnerabilities attackers have used

Every Sitecore vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 4 Sitecore vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2025-53690, added Sep 4, 2025. CMS and Experience Platform (XP) has the most entries (2).

In KEV, all time
4
Added, last 12 months
0
Used in ransomware
1
New CVEs this week
0

By product

CMS and Experience Platform (XP) (2), Multiple Products (1), XP (1).

Every Sitecore entry in CISA KEV

  1. CVE-2025-53690

    Added · due

    Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

    Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to…

  2. CVE-2019-9875

    Added · due

    Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

    Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST…

  3. CVE-2019-9874

    Added · due

    Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

    Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP…

  4. CVE-2021-42237

    RansomwareAdded · due

    Sitecore XP Remote Command Execution Vulnerability

    Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works