CVE-2019-18211: Orckestra c1 CMS

High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days.

An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user.

Affected products

• Orckestra c1 CMS: up to and including 6.6

Published 2019-12-23. Last modified 2026-06-17.