Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-03-26
• EPSS: 84% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

CISA: Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 16 Apr 2025): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

• Patch on synacktiv.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• dev.sitecore.net/Downloads.aspxProductVendor Advisory
• www.synacktiv.com/blog.htmlThird Party Advisory
• www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdfExploitPatchThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource