CVE-2021-42237

sitecore experience platform

Published 5 Nov 2021 · updated 9 Jul 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

References

packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html · Third Party Advisory, VDB Entry
blog.assetnote.io/2021/11/02/sitecore-rce/ · Exploit, Third Party Advisory
support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237 · US Government Resource