Experience Platform vulnerabilities

15 known vulnerabilities in Experience Platform from Sitecore. 15 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  Sitecore Multiple Products Deserialization of Untrusted Data Exploited

  CVE-2025-53690Sep 3, 2025SitecoreEPSS 60.7%

  Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

• 7.5 High severity

  Sitecore Experience Manager (XM): Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-53694Sep 3, 2025SitecoreEPSS 6.85%

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from

• 9.8 Critical severity

  Sitecore Experience Manager (XM): Use of Externally-Controlled Input to Select Classes or Code

  CVE-2025-53693Sep 3, 2025SitecoreEPSS 20.3%

  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.

• 8.8 High severity

  Experience Manager (XM): Deserialization of Untrusted Data

  CVE-2025-53691Sep 3, 2025SitecoreEPSS 1.64%

  Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platf

• 8.8 High severity

  Powershell Extension: Unrestricted Upload of File with Dangerous Type

  CVE-2025-34511Jun 17, 2025SitecoreEPSS 32.4%

  Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using

• 8.8 High severity

  Experience Manager: Relative Path Traversal

  CVE-2025-34510Jun 17, 2025SitecoreEPSS 26.5%

  Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP

• 7.5 High severity

  Experience Manager: Use of Hard-coded Credentials

  CVE-2025-34509Jun 17, 2025SitecoreEPSS 56.2%

  Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attacke

• 7.5 High severity

  experience_platform: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-46938Sep 15, 2024SitecoreEPSS 46.8%

  An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.

• 8.8 High severity

  Experience Platform: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2023-33652Jun 6, 2023SitecoreEPSS 2.49%

  Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.

• 7.5 High severity

  Experience Commerce: Incorrect Authorization

  CVE-2023-33651Jun 6, 2023SitecoreEPSS 1.43%

  An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

• 9.8 Critical severity

  Experience Platform: Deserialization of Untrusted Data

  CVE-2023-27068May 23, 2023SitecoreEPSS 1.74%

  Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.

• 7.5 High severity

  Experience Platform: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2023-27067May 22, 2023SitecoreEPSS 1.65%

  Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx

• 7.2 High severity

  Experience Manager: Unrestricted Upload of File with Dangerous Type

  CVE-2023-26262Mar 14, 2023SitecoreEPSS 1.68%

  An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.

• 9.8 Critical severity

  Sitecore XP Remote Command Execution Exploited

  CVE-2021-42237Nov 5, 2021SitecoreEPSS 97.4%

  Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vuln

• 9.8 Critical severity

  Sitecore CMS and Experience Platform (XP) Deserialization Exploited

  CVE-2019-9874May 31, 2019SitecoreEPSS 83.7%

  Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST p