CVE-2023-27068: Sitecore Experience Platform

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.

Affected products

• Sitecore Experience Platform: before 10.2 (fixed in 10.2)

Published 2023-05-23. Last modified 2026-06-17.