CVE-2019-9874: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-03-26. EPSS: 83.7% chance of exploitation in the next 30 days.

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

Affected products

• Sitecore CMS: from 7.0, up to and including 7.2
• Sitecore Experience Platform: from 7.5, up to and including 8.2

Published 2019-05-31. Last modified 2026-06-17.