{"id":"CVE-2021-42237","published":"2021-11-05T10:15:08Z","modified":"2026-07-09T13:57:14Z","title":"Sitecore XP Remote Command Execution Vulnerability","vendor":"Sitecore","product":"XP","tier":"core","eol":null,"description":{"text":"Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"Sitecore XP, versions 7.5 Initial Release through 8.2 Update-7, contains an insecure deserialization flaw. The vulnerability lies in the product's handling of untrusted serialized data. An attacker with network access can achieve remote command execution on the affected machine, and no authentication, user interaction, or special configuration is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:57:15Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.97566,"percentile":0.99902,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42237","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-25","exploitedFirstSeen":"2022-03-25","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://cisa.gov/news-events/alerts/2022/04/27/2021-top-routinely-exploited-vulnerabilities","date":"2022-04-28"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-117a","date":"2022-04-28"},{"url":"https://unit42.paloaltonetworks.com/network-security-trends-cross-site-scripting/","date":"2022-05-31"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-279a","date":"2022-10-06"},{"url":"https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker","date":"2023-09-20"},{"url":"https://www.secureworks.com/research/threat-profiles/gold-melody","date":"2023-09-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-42237","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2021-42237","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2021-42237","date":"2024-01-24"}],"evidenceTotal":663,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://blog.assetnote.io/2021/11/02/sitecore-rce/","tags":["Exploit","Third Party Advisory"]},{"url":"https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://blog.assetnote.io/2021/11/02/sitecore-rce/","tags":["Exploit","Third Party Advisory"]},{"url":"https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE 2021-42237related to a remote code execution vulnerability through insecure deserialization. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-29215","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-29215","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2022-01-16","earliestUrl":"https://github.com/ItsIgnacioPortal/CVE-2021-42237","repos":[{"name":"ItsIgnacioPortal/CVE-2021-42237","url":"https://github.com/ItsIgnacioPortal/CVE-2021-42237","stars":14,"created":"2022-01-16"},{"name":"vesperp/CVE-2021-42237-SiteCore-XP","url":"https://github.com/vesperp/CVE-2021-42237-SiteCore-XP","stars":1,"created":"2022-06-30"},{"name":"crankyyash/SiteCore-RCE-Detection","url":"https://github.com/crankyyash/SiteCore-RCE-Detection","stars":0,"created":"2022-09-22"}]},"metasploit":[{"name":"Sitecore Experience Platform (XP) PreAuth Deserialization RCE","module":"exploit/windows/http/sitecore_xp_cve_2021_42237","type":"exploit","disclosureDate":"2021-11-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sitecore_xp_cve_2021_42237.rb"}],"nuclei":[{"id":"CVE-2021-42237","name":"Sitecore Experience Platform Pre-Auth RCE","severity":"critical","path":"http/cves/2021/CVE-2021-42237.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42237.yaml"}],"first":{"date":"2021-11-02","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sitecore_xp_cve_2021_42237.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Sitecore Pre-Auth RCE CVE-2021-42237","id":"20c6ed1c-f7f0-4ea3-aa65-4f198e6acb0f","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-42237/web_cve_2021_42237_sitecore_report_ashx.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-42237/web_cve_2021_42237_sitecore_report_ashx.yml","techniques":["T1190"]}]},"exploitRefs":["https://blog.assetnote.io/2021/11/02/sitecore-rce/","http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2021-11-02","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-01-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sitecore_xp_cve_2021_42237.rb","provenance":"source"},{"date":"2021-11-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42237","provenance":"source"},{"date":"2022-03-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-29215","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":140},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1681 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 NVD exploit link; 3 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}