---
id: "CVE-2021-42237"
kind: "vulnerability"
aliases: ["CVE-2021-42237"]
title: "Sitecore XP: Sitecore XP Remote Command Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.97566
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Sitecore XP", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ransomware", "self-hosted", "sitecore-xp", "vendor", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2021-11-05T10:15:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42237", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-42237", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42237", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Sitecore XP: Sitecore XP Remote Command Execution Vulnerability

Sitecore XP contains an insecure deserialization flaw that lets an attacker send crafted requests to run code on the server. It is on CISA's known-exploited list and EPSS rates it 0.976, and the sources tag it with ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Sitecore XP affected ? fixed ?

## Fix

Apply the update per Sitecore's vendor instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42237
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-42237
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-42237

## From the sources

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_