{"id":"CVE-2019-9874","kind":"vulnerability","aliases":["CVE-2019-9874"],"related":[],"title":"Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to…","description":"Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Sitecore CMS and Experience Platform (XP) deserialize untrusted .NET objects sent in the __CSRFTOKEN POST parameter of the Sitecore.Security.AntiCSRF module. An unauthenticated attacker can send a crafted serialized object and run arbitrary code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-03-26T00:00:00+00:00","products":[{"name":"Sitecore CMS and Experience Platform (XP)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sitecore cms","fixed":[],"affected":">= 7.0, <= 7.2","ecosystem":"vendor"},{"name":"sitecore experience platform","fixed":[],"affected":">= 7.5, <= 8.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asp.net","exploited","sitecore","vendor","windows"],"not_affected_if":["not-sitecore"],"how_to_check":null,"fix":"Apply the mitigations from Sitecore's vendor instructions, as CISA directs; the sources do not name a fixed version. If no mitigation is available, discontinue use of the product.","status":"open","published_at":"2019-05-31T21:29:06+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:55+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:48:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from Sitecore's vendor instructions, as CISA directs; the sources do not name a fixed version. If no mitigation is available, discontinue use of the product.","reach":"internet","summary":"Sitecore CMS and Experience Platform (XP) deserialize untrusted .NET objects sent in the __CSRFTOKEN POST parameter of the Sitecore.Security.AntiCSRF module. An unauthenticated attacker can send a crafted serialized object and run arbitrary code on the server.","category":"vendor","who_cares":["sitecore","asp.net","windows"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code on the Sitecore server.","analyst_note":"Find Sitecore's vendor advisory for CVE-2019-9874 and the affected and fixed versions, plus the exact mitigation steps; the sources give none.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-sitecore"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00046,"input_tokens":2611,"output_tokens":398,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':121C '-2019':17A,20A '-9874':18A,21A '22':120C '7.0':15A 'action':111C 'aka':8A 'allow':89C 'and':24A 'anti':9A 'appli':112C 'applic':118C 'arbitrari':69B,95C 'asp.net':33B 'attack':60B,92C 'bod':119C 'cisa':109C 'cloud':124C 'cms':14A,23A,29A,39B,75C 'code':70B,96C 'contain':80C 'craft':64B 'csrf':10A 'csrftoken':51B,108C 'cve':16A,19A 'data':4A 'deseri':1A,44B,82C 'discontinu':127C 'execut':94C 'experi':41B,77C 'experience':25A,31A 'exploit':34B 'follow':117C 'guidanc':122C 'http':105C 'instruct':116C 'mitig':113C,133C 'modul':11A,57B,87C 'net':46B,101C 'object':47B,66B,102C 'paramet':53B,107C 'per':114C 'platform':26A,32A,42B,78C 'post':52B,106C 'product':131C 'requir':110C 'run':68B 'send':62B,98C 'sent':48B 'serial':65B,100C 'server':73B 'servic':125C 'sitecor':13A,35B,38B,74C 'sitecore':22A,28A,30A 'sitecore.security.anticsrf':7A,56B,86C 'unauthent':59B,91C 'unavail':135C 'untrust':3A,45B 'use':128C 'vendor':36B,115C 'vulner':83C 'window':37B 'xp':27A,43B,79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-05-31T21:29:06+00:00","kev":{"dateAdded":"2025-03-26","dueDate":"2025-04-16","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-9874","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874","severity":null,"published_at":"2025-03-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-9874","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9874","severity":null,"published_at":"2019-05-31T21:29:06+00:00","modified_at":"2026-06-17T02:44:46+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}