Vendor

Sitecore

As of , 4 Sitecore vulnerabilities are on CISA's list of exploited vulnerabilities, 1 of them used in ransomware campaigns; 0 were added in 2026. Patch first: CVE-2021-42237.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2021-42237Remote Command ExecutionSitecore XPPatch this weekRansomware use; Metasploit module; EPSS 0.980.98
2CVE-2019-9874DeserializationSitecore CMS and Experience Platform (XP)Patch this weekEPSS 0.840.84
3CVE-2025-53690Deserialization of Untrusted DataSitecore Multiple ProductsPatch this weekEPSS 0.510.51
4CVE-2019-9875DeserializationSitecore CMS and Experience Platform (XP)Patch soon0.14

Products

  • CMS and Experience Platform (XP)2 entries
  • Multiple Products1 entry
  • XP1 entry

Added each year

1232022: 1120222023: nonenone20232024: nonenone20242025: 3320252026: nonenone2026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20221
2023none
2024none
20253
2026none

Used in ransomware