Live › vulnerability › CVE-2021-42237
Go to dashboardSitecore XP contains an insecure deserialization flaw that lets an attacker send crafted requests to run code on the server. It is on CISA's known-exploited list and EPSS rates it 0.976, and the sources tag it with ransomware use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Sitecore XP | vendor | – | – |
Unknown from the sources.
Apply the update per Sitecore's vendor instructions; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2021-42237")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.