CVE-2019-9874
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Description
CVE-2019-9874 is a critical deserialization of untrusted data vulnerability in Sitecore CMS versions 7.0 through 7.2 and Sitecore Experience Platform (XP) versions 7.5 through 8.2. The vulnerability exists in the Sitecore.Security.AntiCSRF module, where an unauthenticated attacker can achieve remote code execution by sending a malicious serialized .NET object in the HTTP POST parameter __CSRFTOKEN. With a CVSS v3.1 score of 9.8 (Critical) and an EPSS score of 78.93% at the 99th percentile, this vulnerability is among the most likely to be exploited across all known CVEs. CISA has added CVE-2019-9874 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sitecore | cms | >= 7.0, <= 7.2 |
| sitecore | experience platform | >= 7.5, <= 8.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://dev.sitecore.net/Downloads.aspx(Product, Vendor Advisory)
- https://www.synacktiv.com/blog.html(Third Party Advisory)
- https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf(Exploit, Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9874(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2019-9874 is classified under CWE-502 (Deserialization of Untrusted Data), a weakness that occurs when an application deserializes data from an untrusted source without verifying that the resulting data is valid and safe. In the Sitecore AntiCSRF module, the __CSRFTOKEN HTTP POST parameter accepts serialized .NET objects that are deserialized without adequate validation. Attackers craft malicious serialized payloads, commonly known as "gadget chains," that trigger arbitrary code execution during the deserialization process. This class of vulnerability consistently enables remote code execution and has been responsible for some of the most severe breaches in recent history.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2019-9874 poses an exceptionally severe threat due to its perfect attack surface characteristics. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and needs no user interaction (UI:N). This means any internet-facing Sitecore CMS or XP instance running affected versions is vulnerable to unauthenticated remote code execution. The impact spans all three dimensions of the CIA triad at the highest level: Confidentiality (High) allows attackers to read all data managed by the Sitecore platform including customer data, content management credentials, and database connection strings; Integrity (High) enables modification of website content, injection of malicious scripts targeting site visitors, and implanting persistent backdoors; Availability (High) permits attackers to disrupt or destroy the entire content management system. The EPSS score of 78.93% at the 99th percentile confirms near-certain exploitation activity, making this one of the most dangerous vulnerabilities for organizations running legacy Sitecore deployments.
Exploit Maturity
CVE-2019-9874 exhibits very high exploit maturity. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 16, 2025. Public exploit documentation is available via the Synacktiv advisory, which provides detailed technical analysis of the deserialization attack vector. The EPSS score of 78.93% at the 99th percentile places this vulnerability among the top 1% most likely to be exploited, reflecting widespread availability of exploitation tools and active threat actor interest. .NET deserialization attacks are well-understood with mature tooling such as ysoserial.net, making exploitation accessible to a broad range of attackers.
Remediation
-
Apply vendor patches immediately. Upgrade Sitecore CMS to a version newer than 7.2 and Sitecore XP to a version newer than 8.2. Consult the Sitecore Downloads page for the latest patched releases that address the deserialization vulnerability in the AntiCSRF module.
-
Restrict network access to the Sitecore CMS administrative and content management interfaces. Place these interfaces behind a VPN or IP-restricted firewall rules to reduce the attack surface while patching is in progress.
-
Implement Web Application Firewall (WAF) rules to inspect and block HTTP POST requests containing serialized .NET objects in the __CSRFTOKEN parameter. Configure rules to detect common .NET deserialization payload signatures and gadget chain patterns.
-
Conduct forensic investigation on any Sitecore instances that were running vulnerable versions while exposed to the internet. Review web server logs for unusual POST requests to endpoints handling CSRF tokens, check for unauthorized file modifications, new user accounts, or webshells, and scan for indicators of compromise.
-
Implement application-level deserialization controls as a long-term hardening measure. Use allowlists to restrict which .NET types can be deserialized, and consider adopting text-based data formats like JSON instead of binary serialization for data interchange where possible.
Technical Details
CVE-2019-9874 targets the Sitecore.Security.AntiCSRF module, which handles Cross-Site Request Forgery protection in Sitecore CMS 7.0 through 7.2 and Sitecore XP 7.5 through 8.2. The vulnerability resides in the processing of the __CSRFTOKEN HTTP POST parameter, which accepts serialized .NET objects. The application uses the .NET BinaryFormatter or similar unsafe deserializer to reconstruct objects from the token value without validating the object types being instantiated. An attacker crafts a malicious serialized .NET object containing a "gadget chain" — a sequence of existing .NET framework classes that, when deserialized, trigger arbitrary method calls leading to OS command execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that exploitation requires only network access with no authentication, no special conditions, and no user interaction, resulting in complete compromise of confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2019-9874 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2019-9874 to the Known Exploited Vulnerabilities catalog. The EPSS score of 78.93% at the 99th percentile further indicates extremely high exploitation activity. Organizations running affected Sitecore versions should treat remediation as an emergency priority.
What products are affected by CVE-2019-9874?
Sitecore CMS versions 7.0 through 7.2 and Sitecore Experience Platform (XP) versions 7.5 through 8.2 are affected. The vulnerability specifically targets the Sitecore.Security.AntiCSRF module used for CSRF token processing.
How do I fix CVE-2019-9874?
Upgrade to a patched version of Sitecore CMS or XP beyond the affected version ranges. As an interim measure, restrict network access to the Sitecore web interface and implement WAF rules to block malicious serialized .NET objects in POST parameters.
How severe is CVE-2019-9874?
CVE-2019-9874 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It allows unauthenticated remote code execution, requires no user interaction, and has an EPSS score at the 99th percentile, making it one of the most dangerous and actively exploited vulnerabilities tracked by CISA.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.