Sitecore Known Exploited Vulnerabilities

Evidence-backed KEV intelligence for Sitecore products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.

Total KEVs

In CISA KEV

Beyond CISA KEV

Sensor Observed

Virtual Patch Available

7 Sitecore KEVs added all time (primary attestation date).

Attested CVEs

CVE	Product	Confidence	CISA KEV	Added
CVE-2025-34509 Sitecore XM and XP Hardcoded Credentials	Experience Manager, Experience Platform	High	Not in CISA	30 Apr 2026
CVE-2024-46938 An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through...	Experience Platform, Experience Manager, Experience Commerce	High	Not in CISA	24 Jul 2025
CVE-2023-35813 Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.	Experience Manager, Experience Platform, Experience Commerce	High	Not in CISA	01 Jul 2025
CVE-2025-53690 Sitecore Products ViewState Deserialization Vulnerability	Experience Manager (XM), Experience Platform (XP)	Confirmed	In CISA	01 Jun 2026
CVE-2021-42237 Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve...	Sitecore XP	Confirmed	In CISA	25 Mar 2022
CVE-2019-9874 Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2...	CMS	Confirmed	In CISA	26 Mar 2025
CVE-2019-9875 Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by...	Sitecore CMS	Confirmed	In CISA	26 Mar 2025