CVE-2019-9875
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Description
CVE-2019-9875 is a high-severity deserialization of untrusted data vulnerability in Sitecore CMS and Experience Platform (XP) through version 9.1. The vulnerability exists in the anti-CSRF (Cross-Site Request Forgery) module, where an authenticated attacker with low privileges can execute arbitrary code on the server by sending a malicious serialized .NET object in an HTTP POST parameter. With a CVSS v3.1 score of 8.8 and an EPSS score of 24.8% at the 96th percentile, CVE-2019-9875 was recently added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of April 16, 2025, indicating renewed exploitation of this years-old vulnerability in Sitecore deployments that remain unpatched.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sitecore | cms | <= 9.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://dev.sitecore.net/Downloads.aspx(Product, Vendor Advisory)
- https://www.synacktiv.com/blog.html(Third Party Advisory)
- https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf(Exploit, Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2019-9875 is classified under CWE-502 (Deserialization of Untrusted Data), a critical weakness where an application deserializes data from untrusted sources without adequate validation. In Sitecore CMS, the anti-CSRF module accepts serialized .NET objects from HTTP POST parameters and deserializes them without verifying that the serialized data contains only expected types. An authenticated attacker can craft a malicious .NET object using known deserialization gadget chains that, when deserialized, execute arbitrary commands on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2019-9875 carries a CVSS v3.1 base score of 8.8 (High) with significant exploitability characteristics. The vulnerability is network-accessible (AV:N) with low complexity (AC:L) and requires only low-level authentication (PR:L) with no user interaction (UI:N). Confidentiality, integrity, and availability are all rated High because successful deserialization of a malicious .NET object achieves arbitrary code execution with the privileges of the Sitecore application process, typically running under IIS with elevated permissions. This grants the attacker the ability to read sensitive data including database connection strings and customer data, modify website content, install web shells for persistent access, and potentially pivot to other systems on the internal network. The EPSS score of 24.8% at the 96th percentile indicates significant exploitation probability, and the KEV catalog addition in 2025 for a vulnerability disclosed in 2019 suggests that many Sitecore installations remain unpatched and are being actively targeted.
Exploit Maturity
CVE-2019-9875 demonstrates mature exploit availability with publicly documented exploitation techniques. Public exploit code and a detailed advisory are available from Synacktiv, who originally discovered and disclosed the vulnerability. CISA has added it to the Known Exploited Vulnerabilities catalog in 2025, confirming renewed active exploitation more than five years after disclosure. The EPSS score of 24.8% at the 96th percentile indicates moderate exploitation probability. The .NET deserialization attack technique is well-understood and tooling such as ysoserial.net provides ready-made gadget chains. The long gap between the 2019 disclosure and the 2025 KEV addition suggests that attackers are specifically targeting legacy Sitecore installations that have not been updated, likely discovered through internet scanning and fingerprinting.
Remediation
-
Upgrade Sitecore CMS to a version newer than 9.1 that includes the fix for the deserialization vulnerability in the anti-CSRF module. Check the Sitecore downloads page for the latest supported versions and upgrade documentation.
-
If immediate upgrading is not possible, apply the vendor-provided patch for the anti-CSRF deserialization vulnerability. Sitecore has released hotfixes for affected versions that restrict the types of objects that can be deserialized through the anti-CSRF module.
-
Implement a web application firewall (WAF) with rules to detect and block serialized .NET objects in HTTP POST parameters. Configure the WAF to inspect POST bodies for Base64-encoded BinaryFormatter payloads and known .NET deserialization gadget chain signatures.
-
Review all Sitecore user accounts and minimize the number of authenticated users, as the vulnerability requires authentication (even with low privileges). Disable any unnecessary accounts, enforce strong passwords, and implement multi-factor authentication for all Sitecore administrative and content management interfaces.
-
Conduct a forensic review of affected Sitecore servers to identify potential compromises. Search for web shells in the Sitecore webroot, unexpected IIS application pools, suspicious scheduled tasks, and unauthorized database modifications. .NET deserialization attacks often result in web shell deployment for persistent access.
Technical Details
CVE-2019-9875 is a deserialization vulnerability in the anti-CSRF (Cross-Site Request Forgery) protection module of Sitecore CMS through version 9.1. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a network-accessible attack requiring only low privileges with maximum impact across all CIA dimensions. The anti-CSRF module is designed to protect against cross-site request forgery attacks by validating tokens embedded in HTTP POST requests. However, the module uses .NET's BinaryFormatter to deserialize data from a POST parameter without implementing type restrictions or validation on the deserialized object graph. An authenticated attacker can replace the legitimate CSRF token with a malicious serialized .NET object that leverages known gadget chains (such as those available in ysoserial.net) to execute arbitrary operating system commands during the deserialization process. The BinaryFormatter deserializer instantiates objects and invokes their constructors and property setters as part of the deserialization workflow, allowing carefully crafted object graphs to trigger command execution through intermediary .NET framework classes. The authentication requirement (PR:L) means any user with valid Sitecore credentials, including content editors with minimal permissions, can exploit this vulnerability.
Frequently Asked Questions
Is CVE-2019-9875 being actively exploited?
Yes. Despite being disclosed in 2019, CISA added CVE-2019-9875 to the Known Exploited Vulnerabilities catalog in 2025, confirming renewed active exploitation. This indicates that unpatched Sitecore installations are being specifically targeted by threat actors.
What products are affected by CVE-2019-9875?
Sitecore CMS and Experience Platform (XP) versions through 9.1 are affected. This includes all releases of the platform up to and including version 9.1. Newer versions include the fix for this vulnerability.
How do I fix CVE-2019-9875?
Upgrade Sitecore CMS to a version newer than 9.1 or apply the vendor-provided hotfix for the anti-CSRF deserialization vulnerability. Additionally, restrict authenticated user access and deploy WAF rules to detect deserialization attack payloads.
How severe is CVE-2019-9875?
CVE-2019-9875 has a CVSS score of 8.8 (High). While it requires authentication, even low-privileged Sitecore users can exploit it to achieve remote code execution. The EPSS score of 24.8% at the 96th percentile confirms significant exploitation activity against legacy Sitecore installations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.