Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-03-26
• EPSS: 14% chance of exploitation in the next 30 days (higher than 97% of CVEs)

[ Description ]Official description

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

CISA: Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 16 Apr 2025): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

• Patch on synacktiv.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• dev.sitecore.net/Downloads.aspxProductVendor Advisory
• www.synacktiv.com/blog.htmlThird Party Advisory
• www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdfExploitPatchThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource